What is the CVSS score of CVE-2026-12400?

CVE-2026-12400 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

FlowForms CVE-2026-12400

EUVD-2026-42847 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 Wordfence

GHSA-qcj5-mp4w-93gp

WordPress Authentication Bypass Wordpress Plugin Flowforms Conversational Form Builder

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible REST endpoint, low complexity, contributor auth required (PR:L), integrity-only impact modifying form content with no code execution or data disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:25 vuln.today

CVE Published

Jul 10, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The FlowForms - Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site - including forms owned by administrators - by supplying an arbitrary form ID in the REST URL.

AnalysisAI

Insecure Direct Object Reference in the FlowForms - Conversational Form Builder WordPress plugin (all versions through 1.1.1) allows authenticated contributors to modify, publish, or revert any form on the site - including forms owned by administrators - by supplying an arbitrary form ID to the unvalidated REST API update_form endpoint. Wordfence reported this flaw, and a fix changeset exists in the WordPress plugin SVN repository, though an explicit patched release version is not independently confirmed. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The vulnerability resides within the REST API handler in the FlowForms plugin file includes/class-rest-api.php, with multiple affected endpoints spanning lines 48, 493, 562, 603, 654, and 694 of the version 1.1.1 source tree, all browsable in the WordPress plugin SVN repository. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the update_form endpoint accepts a form ID directly from the caller's REST URL and performs no ownership or permission check to confirm the requesting user controls that specific form. This is a canonical IDOR pattern - the server verifies only that the object exists, not that the requester is authorized to act on it. CPE cpe:2.3:a:priyanshuchaudhary:flowforms_-_conversational_form_builder:*:*:*:*:*:*:*:* confirms this is a plugin authored by an individual developer under the WordPress.org plugin directory.

RemediationAI

A fix changeset is available in the WordPress plugin SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3577870%40flowforms&new=3577870%40flowforms; however, no explicit patched release version number is confirmed from the available references, making this an upstream fix available via SVN commit with a released patched version not independently verified. Site administrators should monitor the plugin's WordPress.org listing for an updated release above 1.1.1 and apply it through the WordPress plugin dashboard as soon as one is published. As an interim compensating control, audit and minimize the number of accounts holding contributor-level roles or above on sites where form integrity is critical, since the attack surface is gated entirely by PR:L authentication. Disabling the FlowForms REST API endpoint through a firewall or WAF rule targeting the update_form route is a more aggressive but effective mitigation that carries the trade-off of breaking legitimate form editing for all users.