What is the CVSS score of EUVD-2026-40918?

EUVD-2026-40918 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Advanced Form Integration are affected by EUVD-2026-40918?

A privilege escalation vulnerability in the Advanced Form Integration WordPress plugin allows unauthenticated attackers to create administrator accounts and take over affected websites through public…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40918?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40918. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-40918?

24 hours: Audit all Advanced Form Integration form configurations across your WordPress instances to identify any that expose WordPress user-role fields to public form submissions; document affected integrations. 7 days: Upgrade Advanced Form Integration plugin to version 2.1.1 or later on all affected systems. If immediate upgrade is not feasible, disable or restrict affected form integrations to prevent public role field assignment. 30 days: Validate successful upgrade completion; review WordPress access logs for suspicious administrator account creation during the vulnerability window; remove any unauthorized admin accounts.

Advanced Form Integration EUVD-2026-40918

| CVE-2026-11794 HIGH

2026-07-01 WPScan

GHSA-cp9r-mj2w-vwpx

WordPress Information Disclosure Advanced Form Integration Connect Forms To 200 Apps Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but the required non-default role-to-public-field mapping makes it AC:H; successful admin creation yields total C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 11:24 vuln.today

CVSS changed

Jul 01, 2026 - 11:22 NVD

8.1 (None) 8.1 (HIGH)

Patch available

Jul 01, 2026 - 08:01 EUVD

CVE Published

Jul 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026

AnalysisAI

Privilege escalation in the Advanced Form Integration - Connect Forms to 200+ Apps WordPress plugin before 2.1.1 allows unauthenticated visitors to provision a full administrator account through a public form. Because the plugin fails to restrict which WordPress role it assigns during user creation, any site that maps the user-role field to a public form input via an active integration exposes site takeover to anonymous submitters. Publicly available exploit code exists (reported by WPScan), though this is not listed in CISA KEV and requires a specific non-default integration configuration, so real-world exposure is narrower than the 8.1 CVSS suggests.

Technical ContextAI

The affected component is a WordPress plugin that bridges form submissions to 200+ third-party apps and can create WordPress user accounts as part of an integration workflow. The root cause is a missing authorization/role-restriction control on the user-creation routine: when an integration is configured to map the WordPress role to a value taken from a public form field, the plugin trusts that attacker-supplied value and assigns it directly, permitting selection of the 'administrator' role. This is a Broken Access Control / Improper Privilege Management class flaw (CWE not populated in the source data, but behavior matches CWE-269/CWE-266). The CPE identifies the single affected artifact - cpe:2.3:a:unknown:advanced_form_integration_-_connect_forms_to_200+_apps - with no version bound encoded, so the version scope must be read from the EUVD/NVD range rather than the CPE.

RemediationAI

Vendor-released patch: 2.1.1 - update the Advanced Form Integration plugin to version 2.1.1 or later, which restricts the role assignable during form-driven user creation. As an immediate compensating control on sites that cannot patch instantly, edit any active integration so the WordPress user-role field is not mapped to a public/attacker-controllable form input; instead hard-code the role to a low-privilege value such as 'subscriber' (side effect: legitimate role-selection-by-form workflows stop functioning). Where feasible, disable the user-creation action of affected integrations entirely, or place the form behind authentication so anonymous visitors cannot submit it (side effect: blocks public sign-up flows the site may depend on). After patching, audit wp_users for unexpected administrator accounts created via form submissions and rotate credentials if any are found. Reference the WPScan advisory (https://wpscan.com/vulnerability/614b9517-d6d5-499f-8172-280280a312b2/) for detection detail.