The vulnerability identified as CVE-2026-32363 affects the WPLifeCycle plugin by Funlus Oy, specifically versions up to 3.3.1. It is caused by missing authorization checks, which result in incorrectly configured access control security levels. This allows an unauthenticated attacker to perform actions that should require authorization, leading to integrity impact without confidentiality or availability impact. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction.

The impact of this vulnerability is limited to integrity, meaning an attacker could modify data or state within the affected system without proper authorization. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected plugin and review access control configurations to minimize exposure.