The vulnerability identified as CVE-2026-32425 affects the Payment Gateway Pix For GiveWP plugin by linknacional. It is characterized by missing authorization controls, which means that certain operations can be performed without proper access checks. This issue arises from incorrectly configured access control security levels in versions up to and including 2.2.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation information is currently available, and no exploits have been observed in the wild.

The vulnerability allows unauthorized actors to perform actions that could alter data or system state (integrity impact) without requiring privileges or user interaction. There is no impact on confidentiality or availability reported. The medium severity indicates a moderate risk, potentially allowing attackers to manipulate payment gateway operations or related data within the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying strict access control policies at the environment level may help mitigate risk, but no specific mitigations are provided by the vendor at this time.