CVE-2026-32402 describes a missing authorization vulnerability in the Ays Pro Image Slider plugin by Ays, affecting versions up to and including 2.7.1. The issue arises from incorrectly configured access control security levels, allowing unauthorized access to functionality that should be restricted. The vulnerability is network exploitable without requiring privileges or user interaction, impacting the integrity of the affected system but not its confidentiality or availability.

The vulnerability can lead to unauthorized modification or manipulation of the plugin's functionality, potentially impacting the integrity of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the plugin's administrative interfaces and limiting exposure to untrusted networks may reduce risk.