CVE-2026-32408: 
WordPress vulnerability analysis and mitigation

CVE-2026-32408 is a Missing Authorization (Broken Access Control) vulnerability in the Brizy WordPress page builder plugin developed by themefusecom. It affects all versions of the plugin up to and including 2.7.23, and was patched in version 2.7.24. The vulnerability was reported by security researcher Jakub Herman on January 23, 2026, and published by Patchstack on February 22, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. An authenticated attacker with low privileges (Contributor or Developer role) can exploit incorrectly configured access control security levels to perform actions beyond their intended authorization scope. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user with minimal privileges (Patchstack).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged user can perform unauthorized actions within the WordPress site that should be restricted to higher-privileged roles. There is no confidentiality or availability impact based on the CVSS assessment. The scope is unchanged, meaning the impact is confined to the affected WordPress installation, with no direct path to lateral movement or sensitive data exposure (Patchstack).

The vulnerability requires an authenticated session with at least Contributor-level privileges, which limits opportunistic exploitation compared to unauthenticated flaws. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously. No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term, and the vulnerability does not appear in the CISA KEV catalog (Patchstack).

The vendor has released version 2.7.24 of the Brizy WordPress plugin, which resolves this vulnerability. Site administrators should update the Brizy plugin to version 2.7.24 or later immediately. If an immediate update is not possible, site owners should restrict Contributor-level user registrations or consult their hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).