EUVD-2026-36843
GHSA-xhpp-7jwj-prh5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running WPForms ≤ 1.10.0.4
-
DeliverySend unauthenticated request to vulnerable AJAX/REST handler
-
ExploitBypass missing authorization check
-
ExecutionInvoke privileged plugin action
-
ImpactTamper with form or plugin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability of a WordPress site running Contact Form by WPForms (wpforms-lite) at version 1.10.0.4 or earlier with the plugin active; per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, unauthenticated, and needs no user interaction. Limiting factors are that the plugin must actually be installed and activated on a reachable endpoint, and the impact is restricted to integrity - the flaw does not directly disclose data or take the site offline, so sites that proxy WordPress behind an authenticating reverse proxy, IP-restrict admin-ajax.php / wp-json, or have already updated past 1.10.0.4 are not exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated path with high integrity impact only - confidentiality and availability are unaffected, which is consistent with an access-control flaw that lets attackers tamper with plugin state rather than read data or crash the site. KEV status is not asserted in the input and no POC is referenced, so this should be treated as a high-severity but not confirmed actively exploited issue; EPSS is not provided, preventing quantitative exploitation-probability comparison. The very large install base of WPForms and the trivially low attack complexity argue for prompt patching even without exploitation telemetry, but the precise affected endpoint and the concrete integrity action attackers can perform are not disclosed in the Patchstack summary - defenders should consult the Patchstack advisory for specifics before scoping mitigation. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST to a vulnerable WPForms AJAX or REST endpoint on a target WordPress site, invoking a privileged operation that should be limited to administrators - for example modifying a form, altering submission handling, or changing plugin configuration. Because the handler lacks an authorization check, the request succeeds anonymously and the attacker tampers with site data (CVSS I:H) without ever logging in. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Broken access control in the Contact Form by WPForms plugin (versions <= 1.10.0.4) for WordPress allows remote unauthenticated attackers to perform unauthorized actions affecting data integrity. The flaw stems from missing authorization checks (CWE-862) on plugin functionality, enabling tampering without any credentials or user interaction. No public exploit identified at time of analysis, and EPSS data was not provided in the input.
RemediationAI
Upgrade Contact Form by WPForms to a version newer than 1.10.0.4 via the WordPress plugin updater as soon as a fixed release is published; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpforms-lite/vulnerability/wordpress-contact-form-by-wpforms-plugin-1-10-0-4-broken-access-control-vulnerability) for the exact patched version, as the input data does not name one. Patch available per vendor advisory but exact fix version is not independently confirmed from the provided data. Until the update is applied, compensating controls include restricting access to /wp-admin/admin-ajax.php and the WordPress REST API endpoints exposed by WPForms via a WAF rule or Patchstack/Wordfence virtual patch, temporarily deactivating the plugin if the form functionality is non-critical (side effect: contact forms stop rendering and submissions are lost), or scoping IP allow-lists to admin-area requests (side effect: may break legitimate front-end form submissions if applied too broadly). Audit form configurations, submitted entries, and plugin settings for unexpected changes after exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPForms (also known as Contact Form by WPForms / wpforms-lite) is one of the most widely deployed WordPress form-builder plugins, developed by Awesome Motive (CPE: awesomemotive:contact_form_by_wpforms). The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints - typically exposed via WordPress AJAX or REST handlers - execute privileged operations without verifying the caller's capability (e.g., current_user_can) or nonce. Because WordPress plugins commonly register admin-ajax.php actions that are reachable by anonymous users when the underlying handler omits an authorization gate, an unauthenticated HTTP request alone is sufficient to invoke the affected functionality.
Know when Contact Form By Wpforms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network request to a WordPress plugin endpoint missing authorization checks; integrity-only impact per CWE-862 access-control bypass, no confidentiality or availability effect described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.
Executive ViewAI
Contact Form by WPForms plugin for WordPress (versions ≤1.10.0.4) contains a broken access control vulnerability (CVSS 7.5) allowing unauthenticated attackers to manipulate form functionality without authorization. No public exploit identified at time of analysis, but organizations using WPForms risk unauthorized access to customer data and operational disruption. WordPress sites hosting customer inquiries, registrations, or payments require immediate remediation to protect data integrity and business continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable the WPForms plugin and migrate form functionality to alternative providers on non-critical systems, (2) restrict form endpoint access via Web Application Firewall IP allowlisting or reverse proxy authentication to limit exposure, (3) implement enhanced audit logging and real-time alerting on form submissions and related database modifications, (4) conduct daily automated integrity checks on form submission data to detect unauthorized changes, (5) maintain backup and recovery procedures for form data to enable rapid restoration in case of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Contact Form By Wpforms
View allCross-site request forgery in WPForms Lite up to version 1.10.0.2 allows unauthenticated attackers to perform unauthoriz
Reflected cross-site scripting in Contact Form by WPForms (wpforms-lite) through version 2.0.3 lets unauthenticated atta
Contact Form by WPForms versions up to 1.9.8.7 contain an Insertion of Sensitive Information Into Sent Data vulnerabilit
Inadequate authorization controls in WPForms Contact Form plugin version 1.9.9.3 and earlier permit authenticated users
Exploit-DB