EUVD-2026-60812
GHSA-c69m-qfvh-328q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Contributor authentication required (PR:L); network-accessible WordPress endpoint (AV:N); only form data integrity affected, no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
AnalysisAI
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Contributor role - confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) is calibrated by the PR:L metric, which correctly reflects the Contributor authentication prerequisite - a meaningful barrier that eliminates unauthenticated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a Contributor-level account on a WordPress site running RomethemeForm For Elementor 1.2.6 or earlier, then sends a crafted POST request to the plugin's unprotected AJAX or REST endpoint - an action normally restricted to higher-privileged roles. Because the authorization check is absent, WordPress processes the request and the attacker successfully modifies form configurations, submission data, or plugin settings beyond their permitted scope. … |
| Remediation | Update RomethemeForm For Elementor to a version released after 1.2.6; the exact patched version number is not explicitly confirmed in the available intelligence data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/romethemeform/vulnerability/wordpress-romethemeform-for-elementor-plugin-1-2-6-broken-access-control-vulnerability for the latest release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today