What is the CVSS score of CVE-2026-42659?

CVE-2026-42659 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Advanced Form Integration CVE-2026-42659

EUVD-2026-36824 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-7gmg-2w3g-286j

WordPress Authentication Bypass Advanced Form Integration Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable WordPress AJAX endpoint requiring only a subscriber session; no confidentiality or availability impact described, only integrity modification of plugin settings.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:01 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

AnalysisAI

Broken Access Control in the Advanced Form Integration WordPress plugin (versions ≤ 1.126.12) allows authenticated subscriber-level users to perform privileged actions that should be restricted to administrators, due to missing authorization checks (CWE-862). The flaw carries a CVSS 3.1 score of 6.5 with high integrity impact (I:H), meaning a low-privilege attacker can substantially alter plugin or form integration configurations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and broad applicability to any multi-user or open-registration WordPress site make this a meaningful operational risk.

Technical ContextAI

Advanced Form Integration (CPE: cpe:2.3:a:nasir_ahmed:advanced_form_integration:*:*:*:*:*:*:*:*) is a WordPress plugin by Nasir Ahmed that connects WordPress forms to third-party services and APIs. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints - likely AJAX handlers or admin-facing REST routes - fail to verify whether the requesting user holds the required WordPress capability before executing privileged operations. In WordPress, proper access control is implemented via capability checks such as current_user_can() tied to roles like 'administrator' or 'editor'; the Subscriber role is the lowest authenticated role and should not access administrative plugin functions. The absence of these checks allows any authenticated subscriber to invoke restricted functionality, a classic Broken Access Control pattern identified and reported by Patchstack.

RemediationAI

Update the Advanced Form Integration plugin to a version beyond 1.126.12 once the vendor (Nasir Ahmed) releases a patched build - an exact fixed version has not been independently confirmed from the available data, so monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/advanced-form-integration/vulnerability/wordpress-advanced-form-integration-plugin-1-126-12-broken-access-control-vulnerability and the official WordPress plugin repository for an updated release. As a compensating control while awaiting a patch, disable open user registration on the WordPress site (Settings > General, uncheck 'Anyone can register') to prevent untrusted parties from obtaining the subscriber account needed to exploit this flaw - trade-off: this blocks legitimate self-registration for membership or e-commerce workflows. Additionally, audit the current subscriber-level user list for unauthorized accounts and review form integration configurations for unexpected changes to third-party endpoints or API credentials. Consider deactivating the plugin entirely if form integrations are non-critical and the exposure window is unacceptable.