The vulnerability CVE-2026-32336 affects the Rara Business plugin by raratheme, specifically versions up to 1.3.0. It is a missing authorization issue where access control mechanisms are improperly configured, allowing unauthorized users to perform actions that should require higher privileges. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or remediation information is currently available.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions that modify data or settings within the affected plugin. There is no direct impact on confidentiality or availability. The medium severity score reflects the potential for limited integrity compromise without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin's administrative functions and monitor for unusual activity related to access control misuse.