The vulnerability identified as CVE-2026-32496 affects the NYSL Spam Protect for Contact Form 7 WordPress plugin up to version 1.2.9. It is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with high privileges to manipulate file paths beyond intended directories, which can lead to denial of service conditions. The CVSS 3.1 base score is 6.8, reflecting medium severity with network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change. Confidentiality and integrity are not impacted.

The vulnerability can be exploited by an attacker with high privileges to cause denial of service by accessing or manipulating files outside the intended directory restrictions. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict high privilege access to trusted users only to reduce risk.