CVE-2026-57632 is a broken access control vulnerability in the Email Marketing for WooCommerce plugin by Omnisend affecting versions up to 1.19.0. The issue involves missing authorization checks that could allow users with low privileges to execute unauthorized actions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts are possible. No official patch or remediation level has been published yet, and there are no known exploits in the wild.

The vulnerability can lead to unauthorized modification or disruption of the plugin's functionality, impacting the integrity and availability of the affected system. Confidentiality is not impacted. Exploitation requires low privileges and can be performed remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only and monitor for suspicious activity related to privilege misuse.