Executive brief
The FlowForms plugin for WordPress, which is used to create interactive conversational forms, contains a security flaw that allows lower-level users to modify forms they do not own. An attacker with a basic contributor account could change the content, design, or settings of any form on the website, including those created by administrators. This could lead to unauthorized changes to website data collection tools or the disruption of form-based services.
Technical details
The FlowForms plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'update_form' function in the REST API. This vulnerability stems from missing validation on a user-controlled key, specifically the form ID provided in the REST URL. Authenticated attackers with contributor-level permissions or higher can exploit this by supplying an arbitrary form ID to modify, publish, or revert any form on the site, regardless of ownership. The issue is present in all versions up to and including 1.1.1. A patch appears to be available in subsequent updates (changeset 3577870).
Affected products
- priyanshuchaudhary FlowForms – Conversational Form Builder up to, and including, 1.1.1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
References
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/browser/flowforms/tags/1.1.1/includes/class-rest-api.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3577870%40flowforms&new=3577870%40flowforms