The CVE-2026-32452 vulnerability is a Missing Authorization flaw in the ThemeFusion Fusion Builder WordPress plugin. It allows an attacker to bypass configured security levels and perform actions that should be restricted to privileged users, such as modifying or deleting content. Because the flaw is a broken access control issue (CWE-862), the main risk is unauthorized access, potentially leading to data exposure or site compromise. The CVSS score of 5.3 reflects a moderate severity scenario.

The vulnerability affects any installation of the Fusion Builder plugin for WordPress with a version prior to 3.15.0, as indicated by the vendor's product listing. The affected vendor is ThemeFusion, and the product is Fusion Builder. No specific patch version is listed, but the range is from unknown (n/a) until just below 3.15.0. Site administrators should verify the plugin version in use.

With a CVSS score of 5.3 and an EPSS probability of less than 1%, the likelihood of active exploitation is currently low, and the CVE is not cataloged in the KEV database. Nevertheless, the flaw is inherent to the plugin's access control logic and could be exploited by authenticated users or through local vulnerabilities. The attacker would need to identify a role that can misuse the plugin's interface, but no specific attack vector is defined in the description. Administrators should monitor for new exploits and treat the issue as a moderate risk that warrants patching.