The vulnerability CVE-2026-32456 is a Cross-Site Request Forgery (CSRF) issue in the Janis Elsts Admin Menu Editor plugin for WordPress, affecting versions up to and including 1.14.1. It allows an attacker to induce an authenticated user to submit unauthorized requests, potentially modifying settings or configurations without the user's consent. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts integrity but not confidentiality or availability.

The impact is limited to integrity, where an attacker may cause unauthorized changes via CSRF attacks. There is no direct confidentiality or availability impact. The medium CVSS score reflects this limited but non-negligible risk. No known exploits in the wild have been reported, which may reduce immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitoring for suspicious activity related to the plugin's administrative functions is advisable. Avoid clicking on untrusted links while authenticated in environments using this plugin.