CVE-2026-0572 is a missing authorization vulnerability in the WebPurify Profanity Filter WordPress plugin, affecting all versions up to 4.0.2. The issue arises because the 'webpurify_save_options' function lacks a capability check, enabling unauthenticated attackers to change plugin settings. This can lead to unauthorized modification of configuration, potentially impacting the plugin's behavior and availability. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) and does not currently have an official patch or vendor advisory. It is not a cloud service, so remediation requires vendor action and user updates.

An unauthenticated attacker can modify the plugin's settings without authorization, which may lead to altered filtering behavior or denial of service conditions. There is no direct confidentiality impact reported. The integrity and availability of the plugin's functionality are affected due to unauthorized configuration changes. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to WordPress administrative interfaces and ensure that only trusted users can reach the plugin settings. Monitor vendor channels for updates and apply any official patches promptly once available.