CVE-2026-32397: 
WordPress vulnerability analysis and mitigation

CVE-2026-32397 is a Missing Authorization (Broken Access Control) vulnerability in the YMC Filter & Grids WordPress plugin (ymc-smart-filter). It allows unauthenticated network attackers to perform unauthorized data modification actions due to incorrectly configured access control security levels. The vulnerability affects all versions of the plugin through 3.5.1, and was discovered by Jakub Herman and reported on January 21, 2026, with public disclosure on February 20, 2026 via Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged or sensitive actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control levels. No user interaction is required, and the attack complexity is low, making it straightforward to exploit without any special preconditions beyond network access to a vulnerable WordPress installation (Patchstack).

Successful exploitation results in a low integrity impact — unauthenticated attackers can modify data or invoke privileged plugin functionality without authorization. There is no direct confidentiality or availability impact based on the CVSS assessment. While the individual impact is limited, this class of vulnerability is commonly leveraged in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this CVE. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with unlikely exploitation impact, though it notes that broken access control vulnerabilities of this type are used in mass-exploit campaigns against WordPress sites (Patchstack). There is no CISA KEV catalog listing for this vulnerability.

The vendor has released version 3.5.2 of the Filter & Grids plugin, which patches this vulnerability. Site administrators should update the ymc-smart-filter plugin to version 3.5.2 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).