Forms <= 3.0.1 - Authenticated (Contributor+) Missing Authorization to Forms and Submissions Access
- ID
- WPSEC-2026-0101
- Plugin
- Forms (forms-by-made-it)
- Affected
- from 2.0.1 before 3.0.2
- Remediation
- Update to 3.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Forms on WPSec AttackSurface
- Fix released
- Published
Description
The forms-by-made-it plugin for WordPress is vulnerable to unauthorized access in versions 2.0.1 up to, and including, 3.0.1 because the forms and form-submission post types use the generic post capabilities and the plugin's submissions screen, CSV export and madeit/v1/forms REST route are gated only by the edit_posts capability or a nonce printed on that screen. This makes it possible for authenticated attackers, with Contributor-level access and above, to view stored form submissions in the Submitted forms list, export all submissions of any form to CSV, and list and create forms. Submissions may contain sensitive data entered by site visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-0101/
- https://plugins.svn.wordpress.org/forms-by-made-it/tags/3.0.2/
- https://wordpress.org/plugins/forms-by-made-it/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS