EUVD-2026-36970
GHSA-576q-jmx2-x785
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
PR:L because subscriber account is required; S:C because actions affect WordPress components beyond the plugin; no confidentiality impact identified.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
AnalysisAI
Broken access control in Ultra Addons for WPForms (WordPress plugin by Themefic) through version 1.0.11 allows authenticated subscriber-level users to perform privileged actions beyond their intended role. The vulnerability stems from missing authorization checks (CWE-862), enabling a low-privilege attacker with only a subscriber account to manipulate plugin functionality in ways restricted to higher-privilege roles such as administrators or editors. With a CVSS 3.1 score of 6.4 Medium and a scope-changed vector, the impact extends beyond the plugin itself to affect WordPress site integrity and availability. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Technical ContextAI
Ultra Addons for WPForms is a WordPress plugin developed by Themefic (CPE: cpe:2.3:a:themefic:ultra_addons_for_wpforms:*:*:*:*:*:*:*:*) that extends the WPForms form builder. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where PHP functions or AJAX handlers registered by the plugin fail to verify whether the calling user holds sufficient capabilities before executing privileged operations. In WordPress, subscriber is the lowest authenticated role and should have no administrative access. The CVSS scope change (S:C) indicates the missing check allows actions that affect resources or components outside the plugin's own security scope - likely WordPress site content, settings, or form data managed by WPForms itself. This pattern is extremely common in WordPress plugin ecosystems where AJAX action callbacks omit current_user_can() checks or rely solely on nonce verification without capability gating.
RemediationAI
The primary remediation is to update Ultra Addons for WPForms to a version released after 1.0.11; however, a specific patched version number is not confirmed in the available intelligence - verify the current version in the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultra-addons-for-wpforms/vulnerability/wordpress-ultra-addons-for-wpforms-plugin-1-0-11-broken-access-control-vulnerability before updating. If an update is not yet available or cannot be applied immediately, disable user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber-level attack surface entirely - this prevents untrusted users from obtaining the minimum privilege required to exploit the flaw, though it also prevents legitimate new user sign-ups. Alternatively, a web application firewall rule (e.g., via Patchstack Shield or Wordfence) that blocks unauthorized AJAX calls to the plugin's endpoints can serve as a temporary compensating control without requiring registration to be disabled. Deactivating the plugin until a confirmed patched version is available is the most conservative option if WPForms addons functionality is not critical.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today