CVE-2026-32543: 
WordPress vulnerability analysis and mitigation

CVE-2026-32543 is a Missing Authorization vulnerability in the CyberChimps Responsive Blocks (responsive-block-editor-addons) WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 2.2.0. The vulnerability was published on March 13, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. Because no authentication or capability checks are enforced on the affected endpoints, a remote, unauthenticated attacker can interact with restricted functionality. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit (Feedly).

Successful exploitation results in a low-integrity impact — an unauthenticated attacker can perform unauthorized actions that modify data or plugin behavior, though there is no direct confidentiality or availability impact according to the CVSS scoring. The scope is limited to the affected WordPress installation, but unauthorized write or configuration actions could be leveraged to alter site content or settings managed by the Responsive Blocks plugin (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Responsive Blocks (responsive-block-editor-addons) plugin version 2.2.0 or earlier using tools like WPScan or Shodan with WordPress-specific queries.
2. Identify unprotected endpoints: Enumerate the plugin's registered REST API routes or admin-ajax actions that lack capability checks, which can be discovered by reviewing the plugin's source code or using automated WordPress security scanners.
3. Craft unauthorized request: Send an unauthenticated HTTP request (e.g., POST to the vulnerable REST API endpoint or admin-ajax.php action) without any authentication cookies or nonces, exploiting the missing authorization check.
4. Achieve unauthorized action: The server processes the request without verifying permissions, allowing the attacker to perform restricted operations such as modifying plugin settings or site content managed by the Responsive Blocks plugin (Feedly).

• Network: Unexpected unauthenticated POST requests to WordPress REST API endpoints or admin-ajax.php associated with the responsive-block-editor-addons plugin from unknown or suspicious IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin-specific endpoints without valid authentication tokens or nonces; HTTP 200 responses to requests that should require authentication.
• File System: Unexpected changes to plugin configuration files or WordPress options table entries related to Responsive Blocks settings.

Users should update the Responsive Blocks plugin to a version beyond 2.2.0 that includes proper authorization checks, as reported by Patchstack. Until a patched version is available or applied, administrators can mitigate risk by disabling the plugin entirely or restricting access to WordPress REST API endpoints via firewall rules or a Web Application Firewall (WAF). Monitoring WordPress logs for anomalous unauthenticated requests to plugin endpoints is also recommended (Patchstack).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for March 9–15, 2026, which aggregates notable plugin vulnerabilities for the WordPress community (Wordfence). General community reaction has been minimal given the medium severity rating and low EPSS score, with no notable researcher commentary or significant media coverage beyond standard vulnerability aggregation services.