Executive brief
The Flamingo plugin for WordPress, used to manage contact form submissions, contains an authorization vulnerability that allows authenticated contributors to access and enumerate internal form metadata they should not be able to see. Attackers with basic contributor access can discover taxonomy terms, channel names, submission counts, and contact tags through WordPress core APIs, potentially revealing sensitive information about internal business processes, departmental structures, and form purposes.
Technical details
The vulnerability is an authorization bypass in the Flamingo plugin versions up to 2.6.2 caused by incomplete access control enforcement. The plugin implements flamingo_map_meta_cap() filter to restrict access to its admin UI, but this restriction does not extend to WordPress core APIs such as XML-RPC wp.getTerms and AJAX tag-search endpoints. An authenticated attacker with contributor-level or higher privileges can exploit these unprotected APIs to enumerate taxonomy terms, extract channel names derived from Contact Form 7 form titles, retrieve submission counts per channel, and discover contact tag names. The attack requires only basic WordPress authentication and does not involve elevated privileges for those with contributor access or above.
Affected products
- WordPress Flamingo up to and including 2.6.2
Timeline
- 2026-09-07: disclosed