The vulnerability identified as CVE-2026-32394 affects PublishPress Capabilities up to version 2.31.0. It is characterized by missing authorization controls within the capability-manager-enhanced component, which leads to incorrect access control enforcement. This allows users with limited privileges to perform actions they should not be authorized to do, impacting the integrity of the system's capability management. The CVSS v3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows an attacker with low privileges to bypass authorization controls and potentially modify capability settings improperly. This can lead to unauthorized changes in permissions or roles within the PublishPress Capabilities plugin environment. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations within PublishPress Capabilities to limit exposure. Monitor for updates from the vendor and apply patches promptly once available.