CVE-2026-32527: 
WordPress vulnerability analysis and mitigation

CVE-2026-32527 is a Missing Authorization (Broken Access Control) vulnerability in the CRM Perks plugin WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms for WordPress. It affects all plugin versions up to and including 1.1.5, and was patched in version 1.1.6. The vulnerability was reported by researcher Nabil Irawan on January 28, 2026, and published by Patchstack on March 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing a privileged action. An authenticated attacker with low privileges (e.g., Subscriber role) can exploit this flaw over the network without user interaction, by invoking plugin functionality that should be restricted to higher-privileged users. The root cause is a missing or improperly implemented authorization/nonce check in one or more plugin functions that interface with the Insightly CRM integration (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (Subscriber-level or above) to access data or perform actions beyond their intended authorization level. The primary impact is a high confidentiality risk — attackers may be able to read sensitive CRM data (e.g., Insightly contact records, form submission data) that should be restricted to administrators. Integrity and availability are not directly impacted according to the CVSS assessment (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Insightly plugin (versions ≤ 1.1.5) using tools like WPScan or by checking publicly accessible readme files at /wp-content/plugins/cf7-insightly/readme.txt.
2. Obtain low-privilege access: Register or use an existing Subscriber-level account on the target WordPress site (many sites allow open registration).
3. Identify unprotected endpoints: Enumerate WordPress AJAX actions or REST API endpoints registered by the plugin (e.g., via admin-ajax.php) that lack proper capability checks.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with valid nonce/cookie for the low-privilege session) to the vulnerable plugin endpoint, invoking a function intended for administrators.
5. Exfiltrate data: Review the server response for sensitive CRM data (e.g., Insightly API keys, contact records, or form submission data) returned due to the missing authorization check (Patchstack).

• Network: Unusual authenticated POST requests to wp-admin/admin-ajax.php with plugin-specific action parameters from low-privilege user accounts; repeated requests to plugin REST API endpoints from unexpected IP addresses.
• Logs: WordPress access logs showing Subscriber-role users accessing admin-only AJAX actions registered by the cf7-insightly plugin; anomalous access patterns (high frequency, off-hours) from authenticated low-privilege sessions.
• File System: No direct file-system artifacts expected for this vulnerability type, but review for unexpected changes to plugin configuration files in /wp-content/plugins/cf7-insightly/.

The vendor (CRM Perks) has released a patched version: update to WP Insightly version 1.1.6 or later immediately. Site administrators who cannot update immediately should consider temporarily deactivating the plugin or restricting site registration to prevent low-privilege account creation. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated (Patchstack).

The vulnerability was discovered and disclosed by security researcher Nabil Irawan through Patchstack's coordinated disclosure process. Patchstack classified it as medium priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).