CVE-2026-32397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32397", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:11:09.668Z", "datePublished": "2026-03-13T11:42:11.696Z", "dateUpdated": "2026-04-29T09:51:58.759Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ymc-smart-filter", "product": "Filter & Grids", "vendor": "YMC", "versions": [{"changes": [{"at": "3.5.2", "status": "unaffected"}], "lessThanOrEqual": "3.5.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jakub Herman | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:20.325Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Filter & Grids: from n/a through <= 3.5.1.</p>"}], "value": "Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:58.759Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/ymc-smart-filter/vulnerability/wordpress-filter-grids-plugin-3-5-1-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:45:52.041583Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:53:32.512Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:45:52.041583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:45:52.695Z"}}], "cna": {"title": "WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Jakub Herman | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "YMC", "product": "Filter & Grids", "versions": [{"status": "affected", "changes": [{"at": "3.5.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.5.1"}], "packageName": "ymc-smart-filter", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:05:20.325Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/ymc-smart-filter/vulnerability/wordpress-filter-grids-plugin-3-5-1-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Filter & Grids: from n/a through <= 3.5.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:58.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32397", "state": "PUBLISHED", "dateUpdated": "2026-04-29T09:51:58.759Z", "dateReserved": "2026-03-12T11:11:09.668Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-13T11:42:11.696Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "ymc-smart-filter", "product": "Filter & Grids", "vendor": "YMC", "versions": [{"changes": [{"at": "3.5.2", "status": "unaffected"}], "lessThanOrEqual": "3.5.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en YMC Filter &amp; Grids ymc-smart-filter permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Filter &amp; Grids: desde n/a hasta &lt;= 3.5.1."}], "id": "CVE-2026-32397", "lastModified": "2026-06-17T10:35:43.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32397", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T18:45:52.041583Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:55.447", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/ymc-smart-filter/vulnerability/wordpress-filter-grids-plugin-3-5-1-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.5.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.5.2"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "Filter & Grids", "source": "cna", "vendor": "YMC"}, "product": "filter_&_grids", "vendor": "ymc-22"}], "analysis": {"en": {"generated_at": "2026-03-19T16:19:12.477174+00:00", "value": {"mitigation_remediation": ["Update the YMC Filter & Grids plugin to a version newer than 3.5.1 if available.", "Verify that the plugin\u2019s access\u2011control settings are correctly configured so that only authenticated administrators can perform privileged actions (CVE description).", "If a plugin update is not possible, restrict access to the plugin\u2019s administrative URLs by using web\u2011server or firewall rules to allow only authenticated personnel.", "Monitor the website\u2019s logs for unauthorized attempts to access plugin endpoints and investigate any suspicious activity."], "summary": {"action": "Patch Now", "impact": "Unauthorized Access via Broken Access Control"}, "threat_synthesis": {"affected_systems": "All installations of YMC Filter & Grids (ymc\u2011smart\u2011filter) with versions up to and including 3.5.1 are vulnerable as the issue exists from the earliest release through 3.5.1 (CVE description). No fixed version is listed in the CNA data, so the exact affected versions are not explicitly enumerated (KNAWB .)", "description_and_impact": "The YMC Filter & Grids plugin for WordPress contains a Missing Authorization flaw (CWE-862) that allows an attacker to bypass normal access controls and perform unauthorized operations on plugin data (CVE description). This flaw can enable reading, modifying, or deleting content managed by the plugin, thereby compromising confidentiality and integrity of the site\u2019s data (CVE description).", "risk_and_exploitability": "The CVSS score is 5.3, indicating medium severity, and the EPSS score is <1%, showing a low current likelihood of exploitation (SCORES). The vulnerability is not listed in the CISA KEV catalog (SCORES). As no publicly documented exploit is known, the attack vector is inferred to be a misconfiguration or an attacker who can influence plugin access\u2011control settings (inference from CVE description). The risk is therefore theoretical unless the site is misconfigured."}}}}, "created": "2026-03-16T09:34:14.823034+00:00", "updated": "2026-03-23T12:04:04.656327+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "ymc-22", "ymc-22$PRODUCT$filter_&_grids"]}