CVE-2026-42659
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, potentially leading to privacy and security breaches.
Recommendation
It is recommended to upgrade to the latest version of Advanced Form Integration to mitigate this access control vulnerability.
Other vulnerabilities in Advanced Form Integration
See all- CVE-2026-16587Medium
The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.
- CVE-2026-11794High
The Advanced Form Integration plugin for WordPress before version 2.1.1 does not restrict the WordPress role assigned when creating a user from a public form submission. This allows unauthenticated visitors to create an administrator account if an active integration maps the user role to a public form field, requiring a specific non-default configuration.
Original NVD description (English source)
Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.