{"id":"CVE-2026-7050","aliases":["EUVD-2026-29413","GHSA-qpp8-c46f-8gpc"],"status":"published","title":"Forms Rb \u003c= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter","description":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00283,"percentile":0.21028,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-05-12T07:48:22Z","modified":"2026-06-17T11:01:43Z","products":[{"vendor":"rbplugins","product":"forms rb"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b27cde-68d7-439d-aee6-a390035e2022?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L128"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L128"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L623"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L623"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L316"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L316"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L444"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L444"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L190"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L190"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/trunk/app/api.php#L41"},{"url":"https://plugins.trac.wordpress.org/browser/forms-rb/tags/1.1.9/app/api.php#L41"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7050"},{"url":"https://github.com/advisories/GHSA-qpp8-c46f-8gpc"}],"sources":{"cve":[{"id":"CVE-2026-7050","title":"Forms Rb \u003c= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter","description":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.","status":"published","published":"2026-05-12T07:48:22.717Z","modified":"2026-05-12T16:49:10.405Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-29413","description":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.","status":"published","published":"2026-05-12T07:48:22Z","modified":"2026-05-12T16:49:10Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:37.152927Z"}],"ghsa":[{"id":"GHSA-qpp8-c46f-8gpc","title":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to,...","description":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.","status":"published","published":"2026-05-12T09:31:32Z","modified":"2026-05-12T09:31:39Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:08:00.69632Z"}],"nvd":[{"id":"CVE-2026-7050","description":"The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.","status":"published","published":"2026-05-12T09:16:56.907Z","modified":"2026-06-17T11:01:43.01Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:18.613259Z"}]}}