The vulnerability identified as CVE-2026-32440 affects the WP Food plugin by Ex-Themes. It is caused by missing authorization checks, which result in incorrect access control configurations. This flaw allows unauthorized users to perform actions that should require proper authorization, potentially leading to integrity violations. The affected versions include all versions before 2.7.1. The CVSS v3.1 base score is 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

The impact of this vulnerability is limited to integrity, meaning unauthorized modifications or actions could be performed within the WP Food plugin context. There is no impact on confidentiality or availability. Since no known exploits are reported, the immediate risk may be moderate but should be addressed to prevent potential misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Ex-Themes and apply any released patches promptly. Until a fix is available, restrict access to the plugin's administrative interfaces and review access control configurations to minimize exposure.