Executive Summary

CVE-2026-32397 is a Broken Access Control vulnerability found in the WordPress Filter & Grids Plugin versions up to and including 3.5.1.

This issue arises from missing authorization, authentication, or nonce token checks within certain functions, allowing unauthenticated users to perform actions that require higher privileges.

It is classified under the OWASP Top 10 category A1: Broken Access Control.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthenticated users to perform actions that normally require higher privileges due to missing access control checks.

However, the CVSS score is 5.3, indicating a low severity impact and a low priority for exploitation.

Because of its low impact, it is considered unlikely to be exploited in practice.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the WordPress Filter & Grids Plugin versions up to 3.5.1, allowing unauthenticated users to perform privileged actions.

Detection would involve checking the version of the Filter & Grids plugin installed on your WordPress system to see if it is version 3.5.1 or earlier.

A practical command to detect the vulnerable plugin version on your system could be to list the plugin version via WP-CLI:

• wp plugin list --status=active | grep filter-grids

If the version is 3.5.1 or lower, your system is vulnerable.

Since the vulnerability involves missing authorization checks, monitoring for unusual or unauthorized access attempts to plugin endpoints or functions could also help detect exploitation attempts, but specific commands for this are not provided.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate and recommended step to mitigate this vulnerability is to update the WordPress Filter & Grids Plugin to version 3.5.2 or later, where the issue has been patched.'}, {'type': 'paragraph', 'content': 'Alternatively, if updating immediately is not possible, consider disabling the plugin temporarily to prevent exploitation.'}, {'type': 'paragraph', 'content': "Using automated update tools such as Patchstack's automated updates for vulnerable plugins can also provide rapid protection."}] [1]

Useful 0 Not Useful 0