What is the CVSS score of EUVD-2026-43452?

EUVD-2026-43452 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Advanced Forms are affected by EUVD-2026-43452?

The Advanced Forms WordPress plugin (versions through 1.9.3.7) contains a broken access control vulnerability allowing unauthenticated attackers to modify form data and settings.

How to fix or mitigate EUVD-2026-43452?

Within 24 hours: Deactivate the Advanced Forms plugin across all WordPress installations and implement a temporary alternative form solution (manual forms, Gravity Forms, or other patched alternatives). Within 7 days: Audit form submission logs and database tables for unauthorized modifications; preserve evidence and determine scope of any data compromise. Within 30 days: Migrate all forms to a patched alternative plugin and remove Advanced Forms entirely from all installations.

Advanced Forms EUVD-2026-43452

| CVE-2026-57378 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass Advanced Forms

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:06 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through <= 1.9.3.7.

AnalysisAI

Broken access control in the Phil Kurth "Advanced Forms" WordPress plugin (all versions up to and including 1.9.3.7) lets remote unauthenticated attackers reach a form-handling function that fails to verify authorization, enabling unauthorized modification of form data or settings. The CVSS 3.1 score is 7.5 with integrity-only impact and no confidentiality or availability loss. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Deactivate the Advanced Forms plugin across all WordPress installations and implement a temporary alternative form solution (manual forms, Gravity Forms, or other patched alternatives). …

Threat intelligence, references, and detailed analysis are available after sign-in.