The vulnerability identified as CVE-2026-32446 affects the Contact Form by WPForms plugin up to version 1.9.9.3. It is a missing authorization issue where access control is improperly configured, potentially allowing unauthorized access to certain functionalities or data. The CVSS 3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity and low privileges required, resulting in limited confidentiality impact without affecting integrity or availability. There is no indication of an official patch or vendor advisory at this time.

The vulnerability could allow an attacker with low privileges to access or interact with parts of the plugin that should be restricted, potentially leading to limited information disclosure. There is no evidence of impact on data integrity or service availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations related to the Contact Form by WPForms plugin. Monitor vendor channels for updates and apply patches promptly once available.