Advanced Form Integration <= 2.9.0 - Unauthenticated Privilege Escalation via Account Takeover in Ultimate Member 'Update Profile Field' Action
- ID
- WPSEC-2026-0412
- Plugin
- Advanced Form Integration — Connect Forms to 300+ Apps (advanced-form-integration)
- Affected
- from 2.7.0 before 2.10.0
- Remediation
- Update to 2.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Advanced Form Integration on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-104797, on 2026-10-09.
Description
The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions 2.7.0 up to, and including, 2.9.0. The Ultimate Member 'Update Profile Field' action looks up a user by an email address taken from the form submission and writes the configured field key and value to that user without restricting which field may be written, and core account fields such as user_pass and user_email are passed on to wp_update_user(). This makes it possible for unauthenticated attackers who submit a public form connected to this action to change the password or email address of any user whose email address they know, including administrators. Exploitation requires an administrator to have configured the action with its field key mapped from a submitted form field, or set to one of these core account fields, and the Ultimate Member plugin to be active.
References
- https://wpsec.com/vuln/WPSEC-2026-0412/
- https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.10.0/
- https://wordpress.org/plugins/advanced-form-integration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS