{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32441", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:11:35.693Z", "datePublished": "2026-03-25T16:14:57.389Z", "dateUpdated": "2026-03-25T16:14:57.389Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "comments-import-export-woocommerce", "product": "Comments Import & Export", "vendor": "WebToffee", "versions": [{"changes": [{"at": "2.5.0", "status": "unaffected"}], "lessThanOrEqual": "<= 2.4.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jitlada | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:36.144Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Comments Import & Export: from n/a through <= 2.4.9.</p>"}], "value": "Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:57.389Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/comments-import-export-woocommerce/vulnerability/wordpress-comments-import-export-plugin-2-4-9-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9."}], "id": "CVE-2026-32441", "lastModified": "2026-03-25T17:16:59.050", "metrics": {}, "published": "2026-03-25T17:16:59.050", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/comments-import-export-woocommerce/vulnerability/wordpress-comments-import-export-plugin-2-4-9-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.9]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.5.0,*]"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "Comments Import & Export", "source": "cna", "vendor": "WebToffee"}, "product": "wordpress_comments_import_and_export", "vendor": "webtoffee"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T18:38:25.810089+00:00", "value": {"mitigation_remediation": ["Update the plugin to the latest version available from the vendor, which addresses the access control issue.", "If a patch is not immediately available, disable or uninstall the Comments Import & Export plugin to prevent exploitation.", "Restrict access to the import/export functions by applying role\u2011based restrictions or ensuring only trusted administrators have the relevant capabilities.", "Monitor site logs for abnormal import/export activity and audit user accounts for unauthorized changes."], "summary": {"action": "Apply patch", "impact": "Privilege escalation via missing authorization"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts all installations of WebToffee\u2019s Comments Import & Export plugin for WordPress that are version 2.4.9 or earlier. No specific WordPress core version constraints are listed, so any site running the affected plugin version is at risk.", "description_and_impact": "The Comments Import & Export plugin has a missing authorization flaw that allows an attacker to bypass the plugin\u2019s access controls. This vulnerability is identified as CWE-862 and can be used to gain unauthorized access to import or export functionality, potentially leading to data tampering or leakage. The flaw stems from incorrectly configured security levels that fail to validate user permissions before performing plugin actions.", "risk_and_exploitability": "There is no CVSS or EPSS score available. The plugin operates as a WordPress plugin and therefore the attack vector is likely remote via the web interface; an attacker who can interact with the plugin\u2019s import/export endpoints could exploit the flaw without any special privileges. The vulnerability is not currently listed in the CISA KEV catalog, but the potential for unauthorized data manipulation makes it high risk for sites that rely on the plugin\u2019s functionality."}}}}, "created": "2026-03-25T21:43:45.250227+00:00", "updated": "2026-03-26T11:37:44.032351+00:00", "vendors": ["webtoffee", "webtoffee$PRODUCT$wordpress_comments_import_and_export", "wordpress", "wordpress$PRODUCT$wordpress"]}