CVE-2026-32410: 
WordPress vulnerability analysis and mitigation

CVE-2026-32410 is a Missing Authorization (Broken Access Control) vulnerability in the WBW Currency Switcher for WooCommerce WordPress plugin by WBW Plugins (WPFactory). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all plugin versions up to and including 2.2.5. The vulnerability was reported by NumeX on January 24, 2026, and published by Patchstack on February 23, 2026, with CVE assignment on March 13, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated attacker can send crafted network requests to trigger functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels. No authentication, user interaction, or special preconditions are required for exploitation, as the attack vector is network-accessible with low complexity (Patchstack).

Successful exploitation results in a limited confidentiality impact, with no integrity or availability impact according to the CVSS scoring. An unauthenticated attacker may be able to access or invoke restricted plugin functionality related to currency switching settings within WooCommerce stores. While the severity is rated low by Patchstack and the direct impact is constrained, vulnerabilities of this class are commonly leveraged in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously (Patchstack).

The vulnerability requires no authentication and has low attack complexity, making it trivially exploitable by any remote attacker. The EPSS score is approximately 0.017% (0.000170), indicating a low probability of active exploitation in the near term. No evidence of in-the-wild exploitation, public proof-of-concept code, or threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vulnerability is patched in WBW Currency Switcher for WooCommerce version 2.2.6. Site administrators should update the plugin to version 2.2.6 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).