Junglewise Threat Intelligence

CVE-2026-8692: Vedrixa Forms authorization bypass in form builder

CVE-2026-8692 · Severity: medium · CVSS 4.3 · Published 2026-05-22

Executive brief

A vulnerability in the Vedrixa Forms plugin for WordPress allows logged-in users with low-level permissions to modify website forms. This means an attacker could change, add, or remove fields on registration and signup forms, potentially disrupting user signups or altering how data is collected. The issue affects all versions of the plugin up to 1.1.1.

Technical details

The Vedrixa Forms plugin for WordPress (versions up to 1.1.1) fails to perform adequate authorization checks on its form-handling functions. This missing authorization (CWE-862) allows authenticated attackers with subscriber-level permissions or higher to overwrite form structures in the plugin's database table. The vulnerability is exploitable because the required 'ajax-nonce' is exposed on the public frontend via wp_localize_script(). By obtaining this nonce, an attacker can send crafted AJAX requests to add, remove, or alter form fields. A patch appears to be available in the latest changeset.

Affected products

  • Vedrixa Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder Up to and including 1.1.1

Timeline

  • 2026-05-22: disclosed
  • 2026-05-22: advisory

References