The vulnerability CVE-2026-32495 in WP Terms Popup arises from missing authorization checks, which means that certain actions or data can be accessed without proper permission validation. This issue affects all versions up to 2.10.0 of the plugin. The CVSS vector indicates the vulnerability is remotely exploitable over the network without privileges or user interaction, with a high impact on confidentiality but no impact on integrity or availability. No patch or official remediation guidance is currently provided.

An attacker can exploit the missing authorization to gain unauthorized access to sensitive information managed by the WP Terms Popup plugin. The confidentiality impact is high, but integrity and availability are not affected. This could lead to data exposure or leakage depending on the plugin's use context. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if feasible to reduce exposure. Monitor official sources for updates from Link Software LLC regarding patches or mitigations.