CVE-2026-32397
Missing Authorization in YMC Filter & Grids Allows Unauthorized Access
Publication date: 2026-03-13
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ymc | smart_filter | to 3.5.1 (inc) |
| ymc | filter_and_grids | to 3.5.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32397 is a Broken Access Control vulnerability found in the WordPress Filter & Grids Plugin versions up to and including 3.5.1.
This issue arises from missing authorization, authentication, or nonce token checks within certain functions, allowing unauthenticated users to perform actions that require higher privileges.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
The vulnerability allows unauthenticated users to perform actions that normally require higher privileges due to missing access control checks.
However, the CVSS score is 5.3, indicating a low severity impact and a low priority for exploitation.
Because of its low impact, it is considered unlikely to be exploited in practice.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the WordPress Filter & Grids Plugin versions up to 3.5.1, allowing unauthenticated users to perform privileged actions.
Detection would involve checking the version of the Filter & Grids plugin installed on your WordPress system to see if it is version 3.5.1 or earlier.
A practical command to detect the vulnerable plugin version on your system could be to list the plugin version via WP-CLI:
- wp plugin list --status=active | grep filter-grids
If the version is 3.5.1 or lower, your system is vulnerable.
Since the vulnerability involves missing authorization checks, monitoring for unusual or unauthorized access attempts to plugin endpoints or functions could also help detect exploitation attempts, but specific commands for this are not provided.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate and recommended step to mitigate this vulnerability is to update the WordPress Filter & Grids Plugin to version 3.5.2 or later, where the issue has been patched.'}, {'type': 'paragraph', 'content': 'Alternatively, if updating immediately is not possible, consider disabling the plugin temporarily to prevent exploitation.'}, {'type': 'paragraph', 'content': "Using automated update tools such as Patchstack's automated updates for vulnerable plugins can also provide rapid protection."}] [1]