CVE-2026-12853
Received Received - Intake

Authorization Bypass in Flamingo WordPress Plugin

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Wordfence

Description
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-12853
EUVD
EUVD-2026-72365

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp-media flamingo to 2.6.2 (inc)
wpflamingo flamingo to 2.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Flamingo WordPress plugin up to version 2.6.2 has an authorization bypass flaw. It fails to properly verify user permissions for certain actions, allowing authenticated attackers with contributor-level access or higher to access sensitive data. This includes enumerating taxonomy terms, channel names from Contact Form 7 forms, submission counts, and contact tag names.

Detection Guidance

Check WordPress installations for the Flamingo plugin versions up to 2.6.2. Look for unauthorized access to taxonomy terms via XML-RPC wp.getTerms or admin-ajax ajax-tag-search endpoints. Review logs for unusual enumeration of channel names or contact tag names by authenticated users with contributor-level access or higher.

Impact Analysis

If you use the Flamingo plugin, attackers could exploit this to gather internal information about your WordPress site. This might include details about forms, departments, workflows, or user interactions. While it doesn't allow direct data modification, the exposed information could be used for further attacks or reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA requirements for data protection and access controls. Exposure of internal form details or user interaction data may constitute a compliance breach depending on the data involved.

Mitigation Strategies

Update the Flamingo plugin to the latest version beyond 2.6.2. Restrict contributor-level and higher user roles to prevent unauthorized access. Monitor XML-RPC and admin-ajax endpoints for suspicious activity. Consider disabling XML-RPC if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart