CVE-2026-32447: 
WordPress vulnerability analysis and mitigation

CVE-2026-32447 is a Missing Authorization vulnerability in the Atarim (atarim-visual-collaboration) WordPress plugin developed by Vito Peleg. The flaw allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, enabling unauthorized actions. All versions of the plugin through 4.3.2 are affected. It was published on March 13, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions. The attack vector is network-based, requires low privileges (an authenticated WordPress user account), and no user interaction. The vulnerability falls under the broader category of Broken Access Control, where restricted functionality can be accessed by users who should not have permission to do so (Feedly, Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions that affect the integrity of the WordPress site, though confidentiality and availability are not directly impacted per the CVSS assessment. The scope is limited to the affected WordPress installation, with no lateral movement potential beyond the plugin's functionality. The primary risk is unauthorized modification of data or settings managed by the Atarim plugin (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for a valid (low-privileged) WordPress account reduces the attack surface compared to unauthenticated vulnerabilities (Feedly).

Users should update the Atarim WordPress plugin to a version beyond 4.3.2, which addresses the missing authorization checks. Until a patch is applied, site administrators can mitigate risk by restricting plugin access to trusted users only and auditing user roles and capabilities within WordPress. Monitoring the WordPress activity log for unexpected actions performed by low-privileged users is also recommended (Patchstack).