CVE-2026-32350: 
WordPress vulnerability analysis and mitigation

CVE-2026-32350 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress Chocolate House theme by wpradiant. It affects all versions up to and including 1.1.5, allowing unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Legion Hunter on January 14, 2026, and published by Patchstack on February 13, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the affected theme fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting the incorrectly configured access control. No authentication, user interaction, or special preconditions are required for exploitation, as the attack vector is network-accessible with low complexity (Patchstack).

Successful exploitation results in a low integrity impact, allowing unauthenticated attackers to perform actions beyond their intended privilege level on affected WordPress sites. There is no direct confidentiality or availability impact per the CVSS scoring. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with low severity impact and considers it unlikely to be exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor has released version 1.1.6 of the Chocolate House WordPress theme, which patches this vulnerability. Site administrators should update to version 1.1.6 or later immediately via the WordPress dashboard or by contacting their hosting provider or web developer. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation (Patchstack).