Missing Authorization in WebToffee Comments Import & Export Plugin
CVE-2026-32441

7.7HIGH

Key Information:

Vendor

WordPress
Status
Comments Import & Export
Vendor
CVE Published:
25 March 2026

What is CVE-2026-32441?

The WebToffee Comments Import & Export plugin is susceptible to a missing authorization issue. This vulnerability arises from incorrectly configured access control security levels, enabling unauthorized users to exploit the system. Such lapses in authorization may allow attackers to access and manipulate sensitive data or functionalities, potentially compromising the integrity of the comments management process. Users should update to the latest version to mitigate risks.

Affected Version(s)

Comments Import & Export <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/comments...
vdb-entry

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jitlada | Patchstack Bug Bounty Program
.