CVE-2026-32446: 
WordPress vulnerability analysis and mitigation

CVE-2026-32446 is a Missing Authorization vulnerability in the Contact Form by WPForms WordPress plugin (wpforms-lite), classified under CWE-862. It allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels to access restricted application data. The vulnerability affects all versions of the plugin up to and including 1.9.9.3. It was published on March 13, 2026, and assigned by Patchstack. The CVSS v3.1 base score is 4.3 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where certain plugin functionality fails to properly verify whether the requesting user has the appropriate permissions before granting access. The attack vector is network-based, requires low privileges (an authenticated WordPress user account), no user interaction, and low attack complexity. Exploitation involves sending crafted requests to plugin endpoints that lack proper capability checks, allowing access to data or functionality that should be restricted to higher-privileged roles (Feedly, Patchstack).

Successful exploitation results in unauthorized read access to sensitive information within the WordPress application, with no impact on integrity or availability. A low-privileged authenticated attacker (e.g., a subscriber-level user) could access form data or configuration details that should be restricted to administrators. The scope is limited to the affected WordPress instance, with no direct path to remote code execution or lateral movement based on currently available information (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-32446 as of the available data. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target WordPress site, which limits the attacker pool (Feedly).

1. Reconnaissance: Identify WordPress sites running the WPForms Lite plugin (wpforms-lite) at version 1.9.9.3 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain low-privileged access: Register or obtain a low-privileged WordPress account (e.g., subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate WPForms plugin AJAX actions or REST API endpoints that lack proper current_user_can() or capability checks.
4. Send crafted request: Issue an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint, bypassing the expected authorization check.
5. Access restricted data: Retrieve sensitive form submissions, configuration data, or other restricted information returned by the improperly protected endpoint (Feedly).

• Network: Unusual authenticated HTTP POST or GET requests to WPForms plugin AJAX endpoints (e.g., wp-admin/admin-ajax.php with WPForms-specific action parameters) from low-privileged user accounts.
• Logs: WordPress access logs showing repeated requests to WPForms endpoints by subscriber or contributor-level users, particularly outside normal usage patterns.
• Logs: Server-side logs indicating access to form submission data or plugin configuration by accounts that do not normally interact with form management features.

Users should update the Contact Form by WPForms plugin (wpforms-lite) to a version above 1.9.9.3, which contains the fix for this missing authorization issue. No specific configuration-based workaround has been published; upgrading is the recommended and primary remediation step. Site administrators should also audit user roles and restrict account registration if subscriber-level access is not required (Patchstack, Feedly).

The vulnerability received routine coverage from automated vulnerability tracking services and security feeds shortly after disclosure on March 13, 2026. It was noted on Bluesky via CVE tracking accounts and picked up by aggregators such as CVEFeed.io and Infinitsec.net. No notable researcher commentary or significant media coverage beyond standard vulnerability disclosure channels has been identified (Feedly).