CVE-2026-32546: 
WordPress vulnerability analysis and mitigation

CVE-2026-32546 is a Missing Authorization vulnerability in the StellarWP Restrict Content WordPress plugin that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through and including 3.2.22. The vulnerability was published on March 25, 2026, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. Because no authentication or capability checks are enforced on the affected functionality, a remote, unauthenticated attacker can interact with restricted plugin endpoints or features that should be protected by access control. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it straightforward to exploit (Feedly, Patchstack).

Successful exploitation results in a high availability impact — an unauthenticated attacker can disrupt or abuse the plugin's access control mechanisms, potentially causing denial of service or bypassing content restriction rules that gate access to premium or protected content. There is no direct confidentiality or integrity impact indicated by the CVSS scoring, though abuse of broken access control in a membership/content-restriction plugin could indirectly expose protected content to unauthorized users. The scope is limited to the affected WordPress installation (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term (Feedly).

Users should update the Restrict Content plugin by StellarWP to a version beyond 3.2.22 as soon as a patched release is made available. In the interim, site administrators should consider disabling the plugin if it is not critical, or restricting access to the WordPress installation via network-level controls (e.g., firewall rules, IP allowlisting for admin endpoints). Monitoring plugin activity logs for unexpected access patterns is also advisable (Patchstack).