Junglewise Threat Intelligence

CVE-2026-11995: Gutena Forms authorization bypass in form entry management

CVE-2026-11995 · Severity: medium · CVSS 5.3 · Published 2026-08-01

Executive brief

Gutena Forms, a WordPress plugin used for creating contact and booking forms, contains a security flaw that allows unauthorized individuals to manage form submissions. An attacker can remotely mark form entries as read or unread, or permanently delete them without needing a password. This could lead to the loss of customer inquiries, booking data, or feedback, potentially disrupting business operations and communications.

Technical details

The Gutena Forms plugin for WordPress (versions up to 1.9.0) is vulnerable to a Missing Authorization (CWE-862) flaw. The vulnerability exists because the plugin fails to perform proper authorization checks on AJAX actions used to manage form entries. While the plugin uses check_ajax_referer() for validation, the required 'gutena_Forms' nonce is leaked to unauthenticated users via wp_localize_script() on any public page containing a Gutena Forms block. Consequently, a remote, unauthenticated attacker can obtain a valid nonce and invoke administrative functions to change the read/unread status of submissions or permanently trash arbitrary form entries.

Affected products

  • saadiqbal Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder up to, and including, 1.9.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References