CVE-2026-16587
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.
Risk Assessment
Attackers can intercept data submitted through contact and other forms, leading to customer data theft and privacy breaches.
Recommendation
Immediately update the Advanced Form Integration plugin to the latest version that fixes the authorization bypass.
Other vulnerabilities in Advanced Form Integration
See all- CVE-2026-11794High
The Advanced Form Integration plugin for WordPress before version 2.1.1 does not restrict the WordPress role assigned when creating a user from a public form submission. This allows unauthenticated visitors to create an administrator account if an active integration maps the user role to a public form field, requiring a specific non-default configuration.
- CVE-2026-42659Medium
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.
Original NVD description (English source)
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.