CVE Intelligence
Analysis AI-assisted

CVE-2026-32520: Andrew Munro AffiliateWP RewardsWP Plugin Privilege Escalation (CWE-266)

CVE-2026-32520 is an incorrect privilege assignment flaw (CWE-266) in the RewardsWP WordPress plugin from Andrew Munro / AffiliateWP, which the CNA says allows privilege escalation in versions through 1.0.4. The CNA scored it 9.8 (critical) under CVSS 3.1, but the record does not state a fixed version and the lower bound of the affected range is listed as n/a. No confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32520 is an incorrect privilege assignment issue (CWE-266) in the RewardsWP plugin, attributed to Andrew Munro and the AffiliateWP ecosystem. According to the CNA record, it allows privilege escalation in versions up to and including 1.0.4.

Impact

  • The CNA scored the issue 9.8 (critical) under CVSS 3.1, with network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • Privilege escalation means a party may gain capabilities beyond those it was granted. The practical scope depends on how the WordPress site is configured, which the record does not describe.

Affected products and versions

  • Product: RewardsWP (rewardswp plugin), vendor shown as Andrew Munro / AffiliateWP.
  • Affected range: from an unspecified lower bound (listed as n/a) through version 1.0.4 inclusive.
  • The structured affected and fixes fields in the record are empty, so no fixed version is confirmed here.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed active exploitation appears in the sources consulted. EPSS data in the record gives a probability of about 0.483% and a percentile of about 39.874%.

Remediation and mitigation

  • Identify whether RewardsWP is installed and which version is active.
  • If the installed version is 1.0.4 or earlier, consult the Patchstack advisory for vendor guidance and update to a release the vendor identifies as fixed.
  • If no fixed release is available or the plugin is not needed, deactivate and remove it, and consider other controls that limit access to the administrative interface.
  • After any change, confirm the installed plugin version.

Detection guidance

  • Review user accounts for unexpected role or capability changes, especially new accounts with administrator-level rights.
  • Review WordPress and web server logs for unexpected administrative actions related to the plugin.
  • Monitor for unauthorized changes to plugin settings or site content.

Limitations of the available information

  • The lower bound of the affected range is listed as n/a.
  • The record contains no fixed version, no structured affected product list and no vendor-published fix details.
  • The vulnerable component and the exact privileges gained are not described.
  • The CVSS 3.1 score of 9.8 comes from the CNA; a second score entry with the same value is also present.

Frequently asked questions

What does CVE-2026-32520 allow?

According to the CNA record, it allows privilege escalation in the RewardsWP plugin in versions through 1.0.4 inclusive.

Is there a fixed version?

The record does not state a fixed version. Check the Patchstack advisory and the vendor for fix information.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.