CVE-2026-32338
Received Received - Intake
Missing Authorization in Construction Landing Page Plugin

Publication date: 2026-03-13

Last updated on: 2026-03-13

Assigner: Patchstack

Description
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-13
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-13
EPSS Evaluated
2026-06-14
NVD
CVE-2026-32338
EUVD
EUVD-2026-11818
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
raratheme construction_landing_page to 1.4.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-32338 is a Broken Access Control vulnerability in the WordPress Construction Landing Page Theme versions up to and including 1.4.1.

The issue arises from missing authorization, authentication, or nonce token checks within certain functions, which allows unauthenticated users to perform actions that should be restricted to higher privileged users.

It falls under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability allows unauthenticated users to perform privileged actions due to missing access control checks.

However, it has a CVSS severity score of 5.3, indicating a low priority and low impact threat.

Because it requires no privileges to exploit but is considered unlikely to be exploited in a meaningful way, the practical impact is limited.

Users are advised to update to version 1.4.2 or later to mitigate the risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the CVE-2026-32338 vulnerability, users should update the WordPress Construction Landing Page Theme to version 1.4.2 or later.

This update patches the missing authorization and access control issues that allow unauthenticated users to perform privileged actions.

Due to the low severity and low impact of this vulnerability, updating the theme is the recommended immediate step to reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart