The vulnerability CVE-2026-32441 affects the WebToffee Comments Import & Export plugin up to version 2.4.9. It is caused by missing authorization checks in the plugin's access control mechanisms, allowing attackers with low privileges to access sensitive functionality without proper permission. The CVSS 3.1 base score is 7.7 (high), with an attack vector of network, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality with a scope change. No patch or mitigation details have been provided by the vendor or other authoritative sources at this time.

An attacker with low privileges can exploit this vulnerability to gain unauthorized access to comment import and export features, potentially exposing sensitive data. The impact is limited to confidentiality as per the CVSS vector, with no direct impact on integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Comments Import & Export plugin functionality to trusted users only and monitor for unusual activity related to comment import/export operations.