What is the CVSS score of CVE-2026-56069?

CVE-2026-56069 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Toolset Forms are affected by CVE-2026-56069?

The WordPress Toolset Forms plugin (version 2.6.24 and earlier) contains an unauthenticated Insecure Direct Object Reference vulnerability (CVSS 7.5) that allows attackers to delete or corrupt…

How to fix or mitigate CVE-2026-56069?

Within 24 hours: Audit all WordPress deployments for Toolset Forms plugin version 2.6.24 or earlier; disable the CRED Frontend Editor if operationally feasible, or restrict network access via firewall rules. Within 7 days: Deploy WAF rules to block suspicious object ID manipulation patterns and enable audit logging on form submissions; monitor Patchstack advisories for patch notification. Within 30 days: Upon vendor patch release, test and deploy immediately to all affected instances; if no patch is released, escalate with Toolset support for timeline and evaluate plugin replacement options.

Toolset Forms CVE-2026-56069

EUVD-2026-39722 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-xmxx-qpv3-jjw8

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable IDOR (AV:N/AC:L/PR:N/UI:N) where object manipulation disrupts plugin-managed records, giving availability impact only, consistent with the reported C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:56 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

AnalysisAI

Availability-impacting Insecure Direct Object Reference in the WordPress Toolset Forms (CRED Frontend Editor) plugin version 2.6.24 and earlier lets unauthenticated remote attackers manipulate object identifiers to act on records they should not control. The flaw was reported by Patchstack and carries CVSS 7.5; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. Because the CVSS vector scores only Availability (A:H), the practical impact is disruption or destruction of plugin-managed objects rather than data disclosure.

Technical ContextAI

Toolset Forms (distributed under the plugin slug cred-frontend-editor) is a commercial WordPress plugin from OnTheGoSystems that provides front-end content creation and editing forms, letting site visitors submit and edit posts or custom-post-type entries without using the wp-admin backend. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: the application accepts an object identifier supplied in the request and operates on the referenced object without verifying that the requester is authorized for it. In IDOR conditions like this, a sequential or guessable key (post ID, form ID, or submission ID) passed to a form-handling endpoint is trusted directly, so changing the value redirects the operation onto another object belonging to someone else.

RemediationAI

No vendor-released patch version was identified in the available data; the advisory only confirms that versions up to and including 2.6.24 are vulnerable, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cred-frontend-editor/vulnerability/wordpress-toolset-forms-plugin-2-6-24-insecure-direct-object-references-idor-vulnerability?_s_id=cve) and the OnTheGoSystems/Toolset changelog for a fixed release above 2.6.24 and upgrade as soon as one is published. Until a fix is confirmed, compensating controls include placing the affected front-end form endpoints behind a Web Application Firewall or Patchstack's virtual patching to filter manipulated object-ID parameters (trade-off: rule tuning needed to avoid breaking legitimate submissions), restricting or temporarily disabling public-facing Toolset Forms that expose edit or delete actions to unauthenticated users (trade-off: loss of front-end submission functionality), and adding authentication or capability checks in front of those forms via an access-control plugin (trade-off: blocks the anonymous visitor workflows the plugin was deployed to enable).