The vulnerability identified as CVE-2026-32386 affects EnvoThemes Envo Extra versions up to 1.9.13. It stems from missing authorization controls, allowing exploitation of incorrectly configured access control security levels. The CVSS 3.1 base score is 5.4 (medium), with an attack vector over the network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Exploitation of this vulnerability could lead to unauthorized access to certain functions or data within the Envo Extra plugin, potentially resulting in limited confidentiality and integrity breaches. There is no impact on availability. The attacker must have some level of privileges to exploit this issue, and no user interaction is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in Envo Extra to minimize exposure. Monitor for vendor updates and apply patches promptly once available.