The vulnerability identified as CVE-2026-32440 affects the Ex-Themes WP Food plugin for WordPress, specifically versions before 2.7.1. It involves missing authorization controls, which means that certain actions or resources may be accessible without proper permission checks. This incorrect access control can be exploited by attackers to perform unauthorized operations that affect the integrity of the system. The CVSS vector indicates the attack is network-based, requires no privileges or user interaction, and impacts integrity but not confidentiality or availability.

The impact is limited to integrity, meaning unauthorized modifications or actions could be performed within the WP Food plugin context. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Ex-Themes regarding WP Food plugin version 2.7.1 or later. Until a fix is available, restricting access to the plugin's administrative functions and limiting exposure may reduce risk.