The vulnerability identified as CVE-2026-32408 in themefusecom Brizy plugin is due to missing authorization checks, which leads to incorrect access control enforcement. This issue affects all versions up to 2.7.23. The weakness allows an attacker with low privileges to exploit the access control misconfiguration remotely without user interaction. The CVSS 3.1 base score is 4.3, reflecting limited confidentiality impact and no integrity or availability impact. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with low privileges can remotely exploit the missing authorization to gain unauthorized access to certain functions or data within the Brizy plugin. The impact is limited to partial confidentiality loss without affecting integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from themefusecom and apply any security patches promptly once available. No specific temporary mitigations are provided in the available data.