CVE-2026-32495: 
WordPress vulnerability analysis and mitigation

CVE-2026-32495 is a Missing Authorization vulnerability in the WP Terms Popup plugin for WordPress, developed by Link Software LLC. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability affects WP Terms Popup versions from n/a through 2.10.0 (inclusive). It was published on March 25, 2026, with the CVE assigned by Patchstack, and carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the broader category of Broken Access Control, where plugin functionality intended to be restricted is accessible without proper authorization checks (Feedly, Patchstack).

Successful exploitation results in a high confidentiality impact, with no integrity or availability impact reported. An unauthenticated attacker could access sensitive information or restricted plugin functionality that should require elevated privileges, potentially exposing site configuration data or user-related information managed by the WP Terms Popup plugin. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2026-32495. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users of the WP Terms Popup plugin should update to a version beyond 2.10.0 as soon as a patched release is made available by Link Software LLC. In the interim, site administrators should consider deactivating the plugin if it is not critical to site operations, or restricting access to WordPress admin endpoints via firewall rules or web application firewall (WAF) policies. Monitoring plugin activity logs for unexpected access to restricted functionality is also advisable (Patchstack).