WordPress 4.7.32

WordPress 4.7.32 has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 16 are fixed as of August 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (19%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Insufficient Verification Of Data Authenticity.

Every one of the 16 issues recorded for WordPress 4.7.32 has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 4.7.32 vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2017-1000600

WordPress Core < 4.9 - Insecure Deserialization

Read the full analysis

Vulnerability Records

16 records


2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.3 Medium	Elio Gubser (odkdn1)	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.8 Medium	Andrew MacPherson	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.5 Medium	Anonymous	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	0ways	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.9 Medium	moochi	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	Aikido Security	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`CVE-2026-64638`	6.1 Medium	pwn.ai Team	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress 4.7.32 4.7.0 – 7.0.2 · 24 branches	`N/A`	6.4 Medium	Asaf Mozes	Yes
2024-04-04 00:00	WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink WordPress 4.7.32 <= 6.4.3	`CVE-2023-5692`	5.3 Medium	Francesco Carlucci	Yes
2021-11-25 00:00	WordPress Core < 5.8 - Dependency Confusion WordPress 4.7.32 <= 5.7.5	`CVE-2021-44223`	8.1 High	Kamil Vavra	Yes

Showing 1–10 of 16 reports