Gutena Forms CVE-2026-66425

The Gutena Forms plugin must be installed and active on a WordPress site running an affected version (<= 1.9.0). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and no special configuration is needed beyond the plugin being active - exploitation is possible against default plugin deployments. The scope is limited to the WordPress environment (S:U), meaning successful exploitation does not pivot to the underlying server or other hosted applications. Exploitation is constrained to integrity (I:L) and availability (A:L) impacts on form-related functionality; confidentiality impact is listed as N in the CVSS vector, though the 'Information Disclosure' tag in the intelligence feed suggests this may warrant further verification. There is no requirement for victim interaction (UI:N), making this a fully server-side exploitable condition.

The NVD-equivalent CVSS 6.5 (Medium) reflects a moderate-severity issue: network-accessible, zero authentication, low complexity, but with constrained impact (C:N/I:L/A:L, Scope:Unchanged). No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, so there is no confirmed evidence of active exploitation. The 'Information Disclosure' tag conflicts with the C:N in the CVSS vector - this inconsistency should be verified with the vendor or Patchstack advisory, as some authentication bypass vulnerabilities in form plugins also expose submitted form data (e.g., survey responses, booking details) to unauthenticated parties. The absence of a POC and KEV listing, combined with the plugin's relatively modest deployment footprint, reduces real-world priority compared to a high-CVSS score on a ubiquitous component. However, the PR:N/AC:L combination means exploitation requires no setup beyond identifying a vulnerable WordPress site, making automated scanning trivially feasible.

An unauthenticated attacker identifies a WordPress site running Gutena Forms <= 1.9.0 through passive reconnaissance (e.g., WordPress plugin enumeration via readme.txt or plugin asset paths). The attacker sends a crafted HTTP request directly to the vulnerable unguarded endpoint - bypassing authentication via an alternate code path - and performs an action restricted to authenticated users, such as modifying form settings, accessing form submission data, or disrupting form availability. No public exploit code has been identified at time of analysis, but the low complexity suggests an attacker familiar with WordPress plugin authentication bypass patterns could construct a working exploit from the Patchstack advisory alone.