The vulnerability identified as CVE-2026-32363 affects the WPLifeCycle plugin by Funlus Oy, specifically versions up to and including 3.3.1. It is due to missing authorization checks, resulting in incorrectly configured access control security levels. This allows unauthenticated attackers to perform actions that should require authorization, impacting the integrity of the system. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and no confidentiality or availability impact, only integrity impact.

The vulnerability allows unauthorized users to modify data or perform actions without proper authorization, impacting the integrity of the affected system. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to access control. Avoid exposing the plugin to untrusted networks if possible.