CVE-2026-57378
Received Received - Intake

Missing Authorization in Advanced Forms Plugin

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Patchstack

Description
Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through <= 1.9.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-57378
EUVD
EUVD-2026-43452

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
patchstack advanced_forms From 1.0.0 (inc) to 1.9.3.7 (inc)
patchstack advanced_forms 1.9.3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57378 is a high-priority Broken Access Control vulnerability in the WordPress Advanced Forms Plugin versions 1.9.3.7 and earlier.

The flaw occurs due to missing authorization checks, which allows unauthenticated users to perform privileged actions that should normally be restricted.

This means attackers can exploit incorrectly configured access control security levels to gain unauthorized access or perform actions without proper permissions.

Impact Analysis

This vulnerability poses a significant risk because it allows attackers to perform privileged actions without authentication.

Such unauthorized access can lead to manipulation or compromise of website forms and data, potentially affecting thousands of websites in mass exploitation campaigns.

The high severity score (CVSS 7.5) reflects the potential impact and ease of exploitation, making it critical to update or mitigate immediately.

Mitigation Strategies

To mitigate the CVE-2026-57378 vulnerability, users should immediately update the WordPress Advanced Forms Plugin to version 1.9.3.8 or later.

If updating is not immediately possible, applying Patchstack's mitigation rule to block attacks targeting this vulnerability is advised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart