Executive brief
The Forms Rb plugin for WordPress, which is used to create and manage website forms, contains a security flaw that allows unauthorized users to access or modify form data. An attacker with a basic account on the website could read private form submissions, change form settings, or delete records they do not own. This could lead to the loss of sensitive user-submitted information or disruption of website contact forms.
Technical details
The Forms Rb plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) within its API implementation in 'app/api.php'. The software fails to perform adequate permission checks when processing requests to view, edit, or delete form data. An authenticated attacker with at least contributor-level privileges can exploit this by sending crafted network requests to the vulnerable API endpoints. Successful exploitation allows the attacker to bypass intended access controls to read form submission records, alter form configuration settings, and delete records belonging to other users. As of the advisory date, the vulnerability is present in version 1.1.9 and below.
Affected products
- Forms Rb Forms Rb Up to, and including, 1.1.9
Timeline
- 2026-05-12: disclosed: Initial publication of the CVE record.
- 2026-05-12: advisory: Wordfence published the vulnerability details.
References
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php
- https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php