CVE-2026-11794
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Advanced Form Integration plugin for WordPress before version 2.1.1 does not restrict the WordPress role assigned when creating a user from a public form submission. This allows unauthenticated visitors to create an administrator account if an active integration maps the user role to a public form field, requiring a specific non-default configuration.
Risk Assessment
The risk is the potential for unauthorized takeover of the WordPress site by an attacker creating an administrator account. This could lead to full site compromise, data theft, or further attacks.
Recommendation
Immediately update the Advanced Form Integration plugin to version 2.1.1 or later. Additionally, review integration configurations to ensure user roles are not mapped to public form fields.
Other vulnerabilities in Advanced Form Integration
See all- CVE-2026-16587Medium
The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.
- CVE-2026-42659Medium
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.
Original NVD description (English source)
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.