CVE-2026-32367 CRITICAL

CVE-2026-32367: WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability

Vendor Yannick Lefebvre
Product Modal Dialog
Weakness CWE-94 · Code injection
Published March 13, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.

Explanation of Vulnerability in Simple Terms

02Summary

Modal Dialog versions 3.5.16 and earlier contain a code injection vulnerability that allows high-privileged users to execute arbitrary code on the site. The vulnerability affects the scope beyond the component itself. An attacker with administrative or equivalent access can inject and run malicious code, potentially compromising the entire site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with full system access.

Potential impact on your site

04Site Impact

A compromised admin account can execute code affecting the entire site, data, and users.

Conditions required to exploit

05Prerequisites

Attacker must have high-level privileges (admin or equivalent role) and network access.

Key dates

06Disclosure timeline

March 13, 2026 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-27436 WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability CVE-2026-3584 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process CVE-2026-3132 Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability CVE-2026-8832 WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost