PT-2026-39968 · Bplugins · Forms Rb

Nudien Udin · Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-7050

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-7050

Affected Products

Forms Rb

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-7050 · Security Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L128 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L623 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L623 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L190 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L444 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L444 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L316 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L128 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L316 · Note
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L190 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/80b27cde-68d7-439d-aee6-a390035e2022?source=cve · Note