CVE-2026-32472: WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
Affected Software
1 affected component
wordpress/Online Contact Widget<=1.3.0
Event History
Aug 18, 2026
CVE Published
via MITRE·01:59 PM
Data Sourced
via MITRE·01:59 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are in scope?
Sites using the WordPress Online Contact Widget plugin version 1.3.0 or earlier are affected according to the available information. The data does not identify a fixed version or workaround.
2
What does an attacker need to exploit this issue?
No authentication is required, and the vector is network-accessible with low attack complexity. This means an unauthenticated remote attacker can attempt exploitation without user interaction.
3
What is the expected security impact?
The vulnerability is described as broken access control, with high confidentiality impact and no stated integrity or availability impact. The provided data does not specify which information or functions are exposed.