The CVE-2026-32427 vulnerability is a Missing Authorization issue found in the vowelweb VW Education Lite WordPress plugin. The flaw allows an attacker to exploit incorrectly configured access control security levels, enabling them to perform actions reserved for privileged users such as viewing, modifying, or deleting content. This weakness is classified as CWE-862 (Missing Authorization).

All installations of the VW Education Lite plugin from the earliest available version up through version 2.2.0 are affected. The vulnerability applies to any WordPress site that has the plugin installed and has not been upgraded beyond the 2.2.0 release.

The CVSS score of 5.3 indicates a Medium severity. The EPSS score is reported as less than 1%, suggesting that the probability of exploitation in the wild is low at this time. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires only that the attacker exploit the plugin's missing access controls, which can be performed from the web interface without authentication. Consequently, once a site is running a vulnerable version, an attacker with knowledge of the affected plugin could gain unauthorized data access or manipulation capabilities.