CVE-2026-32404
WordPress vulnerability analysis and mitigation

Overview

CVE-2026-32404 is a Missing Authorization (Broken Access Control) vulnerability in the Studio99 WP Monitor WordPress plugin. It affects all versions up to and including 1.0.3, allowing unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on January 22, 2026, by researcher Nabil Irawan and published by Patchstack on February 21, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

Technical details

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting the absence of proper capability checks, authentication verification, or nonce token validation. No special preconditions — such as an existing account or specific server configuration — are required for exploitation (Patchstack).

Impact

Successful exploitation results in a limited confidentiality impact, as reflected in the CVSS score (C:L/I:N/A:N), with no direct integrity or availability consequences. An unauthenticated attacker could access information or functionality intended for privileged users, potentially exposing monitoring data managed by the plugin. The scope is limited to the affected WordPress installation, with no evidence of lateral movement potential beyond the plugin's own functionality (Patchstack).

Exploitability

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the class of vulnerability being used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

Mitigation and workarounds

The vendor has released version 1.0.4 of the Studio99 WP Monitor plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.0.4 or later immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Additional resources


SourceThis report was generated using AI

Related WordPress vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-77115HIGH7.1
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-77116MEDIUM4.3
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-14853MEDIUM4.3
  • woocommerce-bookings
NoYesAug 23, 2026
CVE-2026-77003LOW2.7
  • content-mask
NoYesAug 23, 2026
CVE-2026-13598NONEN/A
  • restrictmate
NoYesAug 23, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management