What is the CVSS score of CVE-2026-7050?

CVE-2026-7050 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Forms Rb WordPress Plugin CVE-2026-7050

EUVD-2026-29413 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-qpp8-c46f-8gpc

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.

AnalysisAI

Forms Rb plugin for WordPress versions up to 1.1.9 contains an authorization bypass vulnerability allowing authenticated contributors and above to read, modify, and delete form submission records and configuration belonging to forms they do not own. The vulnerability stems from insufficient authorization checks in API endpoints (CWE-862), affecting all installations with the plugin active. CVSS score of 4.3 reflects low attack complexity and network accessibility, though impact is limited to integrity and information disclosure within WordPress administrative contexts.

Technical ContextAI

The Forms Rb WordPress plugin exposes multiple REST API endpoints in app/api.php that perform sensitive operations on form data without properly validating user authorization. The vulnerability exists in endpoints handling form submissions, configuration, and deletion operations (evidenced by references to lines 41, 128, 190, 316, 444, and 623 in app/api.php). CWE-862 (Missing Authorization) indicates the plugin implements authentication checks (verifying user is logged in) but fails to implement role-based or ownership-based authorization controls. This allows any authenticated user with contributor role or higher to access and modify resources beyond their permission scope. The CPE cpe:2.3:a:rbplugins:forms_rb:*:*:*:*:*:*:*:* indicates all versions through 1.1.9 are affected.

RemediationAI

Upgrade Forms Rb plugin to the patched version released after 1.1.9 - check the official WordPress Plugin Directory at plugins.wordpress.org/forms-rb/ for the latest version, which includes authorization verification in all form API endpoints. If immediate upgrade is not possible, disable contributor access for all non-essential users and audit contributor-level accounts to ensure they are legitimately trusted. WordPress site administrators should restrict the 'contributor' role capability to read and create posts only, removing any custom capabilities that Forms Rb may add, via functions.php or a capability management plugin. Monitor form submission activity and configuration changes in WordPress audit logs during any delay before patching. Contact the Forms Rb development team at rbplugins on wordpress.org for explicit patch version confirmation.