CVE-2026-32386 discloses a missing authorization flaw – a Broken Access Control – in the EnvoThemes Envo Extra WordPress plugin. The vulnerability is caused by incorrectly configured access control security levels, which allow an attacker to invoke plugin functions without proper authorization. This can lead to unauthorized disclosure or modification of data managed by the plugin, potentially compromising the confidentiality or integrity of a WordPress site’s content.

The affected systems are WordPress installations that include the EnvoThemes Envo Extra plugin with a version of 1.9.13 or older. Any user role, regardless of site configuration, could be targeted, and the plugin’s functionality can be accessed without the required permissions.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Attackers are likely to target the plugin via standard HTTP requests, leveraging the access control bypass to perform unauthorized actions. Early remediation is recommended to prevent potential data compromise.