Advanced Form Integration vulnerabilities
3 known CVE vulnerabilities in Advanced Form Integration, translated and rated.
- CVE-2026-16587Medium
The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.
- CVE-2026-11794High
The Advanced Form Integration plugin for WordPress before version 2.1.1 does not restrict the WordPress role assigned when creating a user from a public form submission. This allows unauthenticated visitors to create an administrator account if an active integration maps the user role to a public form field, requiring a specific non-default configuration.
- CVE-2026-42659Medium
Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.