The raratheme Construction Landing Page plugin up to version 1.4.1 suffers from a missing authorization vulnerability. This means that certain actions or resources within the plugin are accessible without proper access control enforcement, allowing unauthorized users to perform operations that should be restricted. The vulnerability is identified by CVE-2026-32338 with a CVSS v3.1 base score of 5.3, reflecting a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact noted.

Exploitation of this vulnerability could allow an attacker to modify data or perform unauthorized actions within the Construction Landing Page plugin without proper authorization. There is no indication of data disclosure or denial of service impact. The vulnerability affects plugin versions up to 1.4.1. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin functionality and monitor for unusual activity. Avoid exposing the plugin to untrusted users. Follow vendor channels for updates regarding patches or official mitigations.