EUVD-2026-51752
GHSA-8jp6-56wg-29gw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N/PR:N confirmed by nonce exposure to all anonymous visitors; A:L added because permanent data deletion of form submissions constitutes data availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gutena Forms - Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the read/unread status of or permanently trash arbitrary form submission entries belonging to any form. The nonce issued by check_ajax_referer() does not function as an authorization barrier because the nonce action 'gutena_Forms' is emitted to unauthenticated visitors via wp_localize_script() on any public page that contains a Gutena Forms block, making it freely obtainable by anonymous attackers.
AnalysisAI
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Technical ContextAI
Gutena Forms is a WordPress block-based form builder plugin (CPE: cpe:2.3:a:saadiqbal:gutena_forms) that handles form submission management through WordPress AJAX handlers. The vulnerability is rooted in CWE-862 (Missing Authorization): the plugin relies on WordPress's check_ajax_referer() function as its sole gatekeeping mechanism for sensitive AJAX actions (modifying read/unread status, trashing entries). Nonces in WordPress are designed to prevent cross-site request forgery, not to enforce authorization - they are session-bound tokens that verify request origin but carry no privilege information. The critical flaw is that the nonce value for the action 'gutena_Forms' is injected into all public page responses via wp_localize_script() whenever a Gutena Forms block is present, meaning any anonymous visitor can trivially extract it from the page source. The vulnerable AJAX dispatch logic is visible in the plugin source at class-manage-store.php (lines 38, 53, 62) and class-store.php (line 130), consistent across the 1.7.1 and 1.9.0 tagged releases examined in the Trac references.
RemediationAI
Update the Gutena Forms plugin to a version beyond 1.9.0 - a fix was committed to the WordPress plugin repository as changeset 3624033 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3624033%40gutena-forms&new=3624033%40gutena-forms), though the exact patched release version is not independently confirmed in the available data. Site administrators should update via the WordPress dashboard or wp-cli ('wp plugin update gutena-forms') and verify the installed version exceeds 1.9.0. As an interim workaround if immediate update is not feasible, deactivating the Gutena Forms plugin or unpublishing all pages containing Gutena Forms blocks eliminates the public nonce exposure surface, preventing anonymous attackers from obtaining a valid nonce - though this disables form functionality entirely. There is no known configuration-level mitigation that preserves full plugin functionality while blocking exploitation. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/81557da6-c98a-4e71-ab88-e987a3650158 for the latest patch confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today