The vulnerability identified as CVE-2026-32410 affects WBW Currency Switcher for WooCommerce versions up to 2.2.5. It involves missing authorization checks, which means that certain actions or data may be accessible without proper permission verification. This is due to incorrectly configured access control security levels within the plugin. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only. There is no indication of integrity or availability impact. The vulnerability is publicly disclosed but lacks a vendor-provided patch or advisory at this time.

An attacker can exploit this vulnerability remotely without authentication or user interaction to gain unauthorized access to certain data or functions within the WBW Currency Switcher plugin. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known active exploits in the wild, reducing immediate risk. However, the missing authorization could expose sensitive information or configuration details to unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from WBW Plugins and consider restricting access to the plugin's administrative functions where possible. No vendor advisory or patch links are currently available, so no official remediation steps can be recommended at this time.