CVE-2026-12400
Received Received - Intake

Insecure Direct Object Reference in FlowForms WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-12400
EUVD
EUVD-2026-42847

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flowforms conversational_form_builder to 1.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FlowForms – Conversational Form Builder plugin for WordPress has a vulnerability known as Insecure Direct Object Reference (IDOR) in all versions up to and including 1.1.1. This vulnerability exists in the update_form functionality due to missing validation on a user-controlled key.

Because of this, authenticated attackers with contributor-level access or higher can modify any form on the site by supplying an arbitrary form ID in the REST URL. This includes the ability to change content, design, settings, and even publish or revert forms owned by administrators.

Impact Analysis

This vulnerability allows attackers with contributor-level access or above to modify any form on the WordPress site, including those owned by administrators.

  • They can change the content, design, and settings of forms.
  • They can publish or revert forms arbitrarily.

Such unauthorized modifications can lead to misinformation, disruption of form functionality, or potential misuse of forms for malicious purposes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart