{"id":"CVE-2026-16587","aliases":["EUVD-2026-49695","GHSA-r4fx-q4j5-7gqg"],"status":"published","title":"Advanced Form Integration \u003c= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function","description":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00385,"percentile":0.3285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-07-28T05:39:44Z","modified":"2026-07-28T16:17:32Z","products":[{"vendor":"nasirahmed","product":"advanced form integration — connect forms to 200+ apps"},{"vendor":"unknown","product":"advanced form integration — connect forms to 200+ apps"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af913bb1-eff6-47cd-9471-f74bafda1e52?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L98"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L51"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L375"},{"url":"https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L411"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3621411%40advanced-form-integration\u0026new=3621411%40advanced-form-integration"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16587"},{"url":"https://github.com/advisories/GHSA-r4fx-q4j5-7gqg"}],"sources":{"cve":[{"id":"CVE-2026-16587","title":"Advanced Form Integration \u003c= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function","description":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.","status":"published","published":"2026-07-28T05:39:44.028Z","modified":"2026-07-28T14:54:01.926Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-49695","description":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.","status":"published","published":"2026-07-28T05:39:44Z","modified":"2026-07-28T14:54:01Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.399718Z"}],"ghsa":[{"id":"GHSA-r4fx-q4j5-7gqg","title":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to...","description":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.","status":"published","published":"2026-07-28T09:31:28Z","modified":"2026-07-28T09:31:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:51.995252Z"}],"nvd":[{"id":"CVE-2026-16587","description":"The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.","status":"published","published":"2026-07-28T07:16:42.13Z","modified":"2026-07-28T16:17:32.807Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:33.249634Z"}]}}