EUVD-2026-51752
GHSA-8jp6-56wg-29gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVisit public page with Gutena Forms block
-
DeliveryExtract 'gutena_Forms' nonce from wp_localize_script response
-
ExploitCraft AJAX POST to admin-ajax.php with extracted nonce
-
ExecutionInvoke unprotected trash/status-update handler
-
ImpactPermanently delete or manipulate form submission entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the Gutena Forms plugin installed and active (versions 1.9.0 and below), and that at least one page containing a Gutena Forms block is published and accessible to anonymous (unauthenticated) visitors - which is the standard, intended deployment for any public-facing contact or booking form. This is not a non-default configuration; it describes the typical operational state of any site using this plugin for its intended purpose. Limiting factors include: the attacker must be able to reach the WordPress site's public pages and admin-ajax.php endpoint (standard network access), and must know or enumerate valid form submission entry IDs to target specific records. No authentication, no existing account, and no elevated privilege of any kind is required. |
| Impact | The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the attack friction: exploitation is trivially easy, requiring no authentication and no special configuration beyond the plugin being installed with at least one public page containing a Gutena Forms block. However, CVSS partially undersells the business impact - the ability to permanently trash form submissions means loss of booking requests, customer inquiries, and survey responses that may not be recoverable. No EPSS data was provided in the input, but given the low barrier to exploitation and the niche footprint of the plugin, widespread automated exploitation appears unlikely; targeted harassment of specific WordPress sites is more realistic. CISA KEV does not list this vulnerability and no public proof-of-concept has been identified in the provided data, which reduces urgency relative to the CVSS vector alone. The Wordfence changeset reference (revision 3624033) strongly suggests a patch was committed, making remediation straightforward. Overall priority: medium for sites using this plugin to capture business-critical data; lower for informational-only forms. |
| Exploit ScenarioDerived | An attacker visits any publicly accessible page on a WordPress site that contains a Gutena Forms block, extracts the 'gutena_Forms' nonce value from the page's JavaScript variables injected by wp_localize_script(), and then sends crafted AJAX POST requests to the WordPress admin-ajax.php endpoint using that nonce to invoke the unprotected handlers - iterating over submission entry IDs to permanently delete all form submissions or mark them as unread, requiring no account or special access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 01, 2026
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
RemediationAI
Update the Gutena Forms plugin to a version beyond 1.9.0 - a fix was committed to the WordPress plugin repository as changeset 3624033 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3624033%40gutena-forms&new=3624033%40gutena-forms), though the exact patched release version is not independently confirmed in the available data. Site administrators should update via the WordPress dashboard or wp-cli ('wp plugin update gutena-forms') and verify the installed version exceeds 1.9.0. As an interim workaround if immediate update is not feasible, deactivating the Gutena Forms plugin or unpublishing all pages containing Gutena Forms blocks eliminates the public nonce exposure surface, preventing anonymous attackers from obtaining a valid nonce - though this disables form functionality entirely. There is no known configuration-level mitigation that preserves full plugin functionality while blocking exploitation. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/81557da6-c98a-4e71-ab88-e987a3650158 for the latest patch confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gutena Forms is a WordPress block-based form builder plugin (CPE: cpe:2.3:a:saadiqbal:gutena_forms) that handles form submission management through WordPress AJAX handlers. The vulnerability is rooted in CWE-862 (Missing Authorization): the plugin relies on WordPress's check_ajax_referer() function as its sole gatekeeping mechanism for sensitive AJAX actions (modifying read/unread status, trashing entries). Nonces in WordPress are designed to prevent cross-site request forgery, not to enforce authorization - they are session-bound tokens that verify request origin but carry no privilege information. The critical flaw is that the nonce value for the action 'gutena_Forms' is injected into all public page responses via wp_localize_script() whenever a Gutena Forms block is present, meaning any anonymous visitor can trivially extract it from the page source. The vulnerable AJAX dispatch logic is visible in the plugin source at class-manage-store.php (lines 38, 53, 62) and class-store.php (line 130), consistent across the 1.7.1 and 1.9.0 tagged releases examined in the Trac references.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N/PR:N confirmed by nonce exposure to all anonymous visitors; A:L added because permanent data deletion of form submissions constitutes data availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Gutena Forms - Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action 'gutena_Forms' is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB