Advanced Form Integration EUVD-2026-96037

Requires that the site has the Advanced Form Integration plugin, Ultimate Member, and Contact Form 7 all active, AND that an administrator has pre-configured a Contact Form 7 integration mapping public form inputs to the Ultimate Member 'Update Profile Field' action with the target email, field key, and value sourced from public form fields - the plugin's own advertised workflow for this action. Given that configuration, exploitation is remote and unauthenticated (PR:N): the attacker simply submits the public form with a victim's email, 'user_pass' as the field key, and a chosen value, and no submitter identity verification, ownership check, capability check, current-password reauthentication, or sensitive-key restriction is enforced (the account context explicitly bypasses Ultimate Member's banned-key validation). The decisive limiting factor is that this specific non-default integration must already exist; sites without such a form mapping are not exploitable, which is why CVSS assigns AC:H.

This is a genuinely high-impact flaw but with a meaningful exploitation gate, so raw CVSS 8.1 overstates the universal risk. The CVSS vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) correctly captures that a successful attack is network-based, unauthenticated, and yields full compromise - an unauthenticated attacker can reset any user's password, including Administrator, leading to full site takeover. The AC:H is doing important work: exploitation is only possible if an administrator has pre-configured a Contact Form 7 → Ultimate Member 'Update Profile Field' integration that maps public form inputs to the target email, field key, and value. No KEV listing, no EPSS score, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' Signals are consistent rather than conflicting: the serious impact (I:H/C:H/A:H) is tempered by the configuration prerequisite reflected in AC:H. The practical priority is HIGH specifically for sites running this plugin alongside Ultimate Member and Contact Form 7 with the described mapping configured; for the broader install base lacking that configuration, real-world exploitability is much lower. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

On a site where an administrator has published a public Contact Form 7 form wired to the plugin's Ultimate Member 'Update Profile Field' action, an unauthenticated attacker submits the form supplying an administrator's email, the field key 'user_pass', and an attacker-chosen password. The plugin resolves the user by email and writes the new password with no ownership, capability, or reauthentication check, letting the attacker log in as administrator and take over the site. No public exploit code was identified at time of analysis.