CVE-2026-32417: 
WordPress vulnerability analysis and mitigation

CVE-2026-32417 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress Pochipp plugin by wppochipp. It affects all versions of Pochipp prior to 1.18.9 and allows authenticated attackers with low privileges (Subscriber level) to exploit incorrectly configured access control security levels. The vulnerability was reported on January 26, 2026, by researcher Nabil Irawan and published by Patchstack on February 25, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation results in limited but unauthorized access to restricted plugin functionality, with low impact to both confidentiality and integrity and no impact to availability. An attacker with a basic WordPress account (e.g., Subscriber) could perform actions intended only for higher-privileged users such as editors or administrators. While the individual impact per site is low, the vulnerability is noted as being used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

The vulnerability has a low EPSS score of approximately 0.017%, indicating a currently low probability of active exploitation in the wild. No public proof-of-concept exploit code or threat actor attribution has been identified at this time. However, Patchstack notes that broken access control vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites regardless of their size or traffic (Patchstack). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The vendor has released version 1.18.9 of the Pochipp plugin, which patches this vulnerability. Site administrators should update the Pochipp plugin to version 1.18.9 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).