What is the CVSS score of CVE-2026-32527?

CVE-2026-32527 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-32527?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wp Insightly For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms CVE-2026-32527

Q: Which versions of Wp Insightly For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms are affected by CVE-2026-32527?

CVE-2026-32527 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

EUVD-2026-15893 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-4c9q-3pjj-52vf

Authentication Bypass Wp Insightly For Contact Form 7 Wpforms Elementor Formidable And Ninja Forms Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15893

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.5.

AnalysisAI

WP Insightly plugin versions 1.1.5 and earlier for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms contain an authorization bypass that allows unauthenticated attackers to modify data through misconfigured access controls. An attacker can exploit this vulnerability to perform unauthorized actions on forms and contacts without proper permissions. No patch is currently available.

Technical ContextAI

The vulnerability resides in the WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms WordPress plugin (CPE: cpe:2.3:a:crm_perks:wp_insightly_for_contact_form_7,_wpforms,_elementor,_formidable_and_ninja_forms:*:*:*:*:*:*:*:*), which integrates multiple form builders with Insightly CRM. The root cause is classified under CWE-862 (Missing Authorization), meaning the plugin fails to properly verify user permissions before granting access to sensitive functions or data. This typically occurs when role-based access control (RBAC) checks are missing or inadequately implemented in AJAX handlers, REST API endpoints, or form processing functions, allowing any authenticated or unauthenticated user to interact with form submissions, contact data, or CRM configurations without proper privilege validation.

RemediationAI

Immediately upgrade the WP Insightly plugin to a version later than 1.1.5 (check the official plugin repository or CRM Perks vendor site for the patched release). Until patching is completed, enforce strict access controls by: restricting plugin access via WordPress user roles and capabilities, disabling the plugin if not actively in use, and implementing server-level access restrictions to form submission endpoints via Web Application Firewall (WAF) rules to block unauthorized access patterns. Additionally, audit existing form submissions and CRM records for unauthorized modifications or data exfiltration, and enable WordPress security logging to detect exploitation attempts. For detailed patching instructions, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/cf7-insightly/.