Ultra Addons for WPForms EUVD-2026-36970

Exploitation requires the attacker to hold at minimum a WordPress subscriber account on the target site. This is the critical limiting factor: if the target WordPress installation has open user registration enabled (WordPress default allows self-registration as a subscriber), any unauthenticated internet user can register and then exploit the flaw. If user registration is disabled or restricted, an attacker must obtain credentials through other means (phishing, credential stuffing, prior breach). No special plugin configuration or non-default settings are indicated as prerequisites beyond the plugin being installed and active. The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L) and requires no user interaction (UI:N). The specific privileged actions accessible to a subscriber are not enumerated in available intelligence - the exact functionality exposed without authorization is not confirmed beyond the broken-access-control classification.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) scores 6.4 Medium. Attack complexity is low and no user interaction is required, but exploitation requires at minimum a valid subscriber account, limiting opportunistic mass exploitation - an attacker cannot abuse this without first registering or obtaining credentials for the target WordPress site. The scope change elevates concern slightly above a typical low-integrity flaw, suggesting impact can propagate to forms or site components beyond the plugin itself. No EPSS data was provided in the intelligence set; without it, probability of widespread automated exploitation cannot be quantified. KEV status is negative and no POC has been identified, classifying this as no public exploit identified at time of analysis. Real-world priority is moderate: sites with open user registration (allowing anyone to become a subscriber) face a meaningfully higher attack surface than sites with closed or invite-only registration. Defenders should weight the registration policy of the target WordPress site heavily when triaging this CVE.

An attacker registers a free subscriber account on a WordPress site running Ultra Addons for WPForms 1.0.11 or earlier, then sends crafted authenticated HTTP requests to the plugin's unprotected AJAX or REST endpoints, invoking privileged operations - such as modifying form configurations, toggling plugin settings, or disrupting form availability - that should be restricted to administrators. No public exploit code has been identified at time of analysis, but the low attack complexity and scope change make manual exploitation straightforward for anyone familiar with WordPress plugin auditing techniques.