CVE-2026-7050

The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.

• CWE-862

• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L128
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L190
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L316
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L41
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L444
• https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L623
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L128
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L190
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L316
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L41
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L444
• https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L623
• https://www.wordfence.com/threat-intel/vulnerabilities/id/80b27cde-68d7-439d-aee6-a390035e2022?source=cve

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7049The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugi…7.2
• CVE-2026-70490Open WebUI is an extensible, feature-rich, and user-friendly…6.3
• CVE-2026-70491Open WebUI is an extensible, feature-rich, and user-friendly…6.5
• CVE-2026-70492Open WebUI is an extensible, feature-rich, and user-friendly…8.7
• CVE-2026-70493Open WebUI is an extensible, feature-rich, and user-friendly…6.5
• CVE-2026-70494Open WebUI is an extensible, feature-rich, and user-friendly…8.1
• CVE-2026-7051The Blog2Social: Social Media Auto Post & Scheduler plugin f…5.4
• CVE-2026-7052The HT Contact Form – Drag & Drop Form Builder for WordPress…7.2
• CVE-2026-7053A security flaw has been discovered in Tenda F456 1.0.0.5. T…8.8
• CVE-2026-7054A weakness has been identified in Tenda F456 1.0.0.5. This v…8.8
• CVE-2026-70547An authenticated user without repository read permission may…4.3
• CVE-2026-7055A security vulnerability has been detected in Tenda F456 1.0…8.8