The vulnerability identified as CVE-2026-32428 affects the Ays Pro Popup Like box plugin, specifically versions up to and including 3.7.7. It is characterized by missing authorization controls, which means that the plugin does not properly restrict access to certain functions or data. This incorrect access control can be exploited by attackers without privileges to perform unauthorized actions. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, impacting integrity but not confidentiality or availability.

The impact of this vulnerability is limited to integrity, meaning attackers could potentially perform unauthorized modifications or actions within the affected plugin. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if feasible to reduce exposure.