CVE-2026-32562
Missing Authorization in WP Folio Team PPWP
Publication date: 2026-03-25
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| folio_team | ppwp_password_protect_page | to 1.9.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32562 is a Broken Access Control vulnerability in the WordPress PPWP Plugin versions up to and including 1.9.15. It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions.
This flaw allows users with Contributor or Developer privileges—who normally have limited access—to perform actions that should be restricted to higher-privileged users.
The vulnerability falls under the OWASP Top 10 category A1: Broken Access Control and has a CVSS severity score of 5.4, indicating a low priority risk.
How can this vulnerability impact me? :
This vulnerability can allow users with lower privileges (Contributor or Developer) to perform unauthorized actions that should be restricted to higher-privileged users.
Such unauthorized actions could lead to integrity and availability impacts on the affected WordPress site, as indicated by the CVSS vector (Integrity: Low impact, Availability: Low impact).
Although the risk is considered low severity and unlikely to be widely exploited, it can be targeted in mass campaigns affecting many websites regardless of their traffic or popularity.
The recommended mitigation is to update the PPWP Plugin to version 1.9.16 or later to patch the vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability arises from missing authorization checks in the PPWP Plugin, allowing users with Contributor or Developer privileges to perform unauthorized actions. Detection involves monitoring for unusual privilege escalations or unauthorized actions within the WordPress environment.
Specific commands or network detection methods are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to update the PPWP Plugin to version 1.9.16 or later, where the vulnerability is patched.
Until the update is applied, Patchstack provides an automatic mitigation rule to block attacks targeting this vulnerability.
Using Patchstack's auto-update options and rapid vulnerability mitigation services can also help protect affected WordPress sites.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-32562 is a Broken Access Control vulnerability that allows users with Contributor or Developer privileges to perform actions reserved for higher-privileged users due to missing authorization checks.
While the vulnerability involves incorrect access control, the provided information does not explicitly describe its direct impact on compliance with common standards and regulations such as GDPR or HIPAA.