CVE-2026-32457: 
WordPress vulnerability analysis and mitigation

CVE-2026-32457 is a Missing Authorization vulnerability in the Advanced Product Fields (Product Addons) for WooCommerce plugin developed by Wombat Plugins. It allows unauthenticated, network-based attackers to exploit incorrectly configured access control security levels, potentially modifying product data on affected WooCommerce stores. The vulnerability affects all plugin versions from n/a through 1.6.18. It was published on March 13, 2026, with Patchstack credited as the assigner. The CVSS v3.1 base score is 5.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations related to product fields. Because no authentication or capability check is enforced on the relevant endpoints or AJAX actions, any unauthenticated network attacker can trigger restricted functionality. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it straightforward to exploit against any unpatched installation (Patchstack, Feedly).

Successful exploitation results in a low-level integrity impact — unauthenticated attackers can modify product field data on WooCommerce stores running the vulnerable plugin versions (≤ 1.6.18). There is no direct confidentiality or availability impact per the CVSS scoring. While the individual impact is limited, unauthorized modification of product add-on fields could disrupt store operations, alter pricing or product options, or be chained with other vulnerabilities for broader compromise (Feedly, Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

WordPress site administrators should update the Advanced Product Fields (Product Addons) for WooCommerce plugin to a version beyond 1.6.18, which resolves the missing authorization issue. If an immediate update is not possible, consider temporarily deactivating the plugin until a patch can be applied. Restricting access to WordPress admin and plugin endpoints via a web application firewall (WAF) can provide additional defense-in-depth (Patchstack, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for March 9–15, 2026, and Sucuri referenced it in their March 2026 vulnerability patch roundup, indicating routine coverage within the WordPress security community. No notable researcher commentary or significant social media discussion beyond standard CVE tracking has been observed (Wordfence, Sucuri).