Advanced Form Integration vulnerabilities

The Advanced Form Integration plugin up to version 2.9.0 is vulnerable to Authentication Bypass via Unverified Password Change. The adfoin_ultimatememberac_send_data function passes an attacker-controlled field key and value directly to UM()->user()->update_profile() in the 'account' context, which bypasses Ultimate Member's banned-key validation, without any identity verification, ownership check, capability check, or current-password reauthentication. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, via a public Contact Form 7 form.

The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.

The Advanced Form Integration plugin for WordPress before version 2.1.1 does not restrict the WordPress role assigned when creating a user from a public form submission. This allows unauthenticated visitors to create an administrator account if an active integration maps the user role to a public form field, requiring a specific non-default configuration.

Versions of Advanced Form Integration up to 1.126.12 have a vulnerability in access control that may allow subscribers unauthorized access to resources.