CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR：未经授权的表单修改 已认证（贡献者+）的不安全直接对象引用，导致FlowForms ≤ 1.1.1 中任意表单可被修改 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-12400 CVSS 评分| 4.3 — 中等 CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CWE| CWE-639（通过用户控制密钥绕过授权） 产品| FlowForms — WordPress 对话式表单构建器插件 受影响版本| 所有版本，包括 1.1.1 修复版本| ...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms 未授权表单发布 已认证（贡献者及以上）授权绕过，可在 FlowForms ≤ 1.1.1 中发布任意草稿表单 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-11991 CVSS 评分| 6.2 — 中危 CVSS 向量| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C CWE| CWE-639（通过用户可控密钥绕过授权） 产品| FlowForms — WordPress 对话式表单构建插件 受影响版本| 所有版本，最高至 1.1.1 修复版本| 1.1.2...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-42847

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400 FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400

FlowForms (WordPress plugin)

CVE-2026-12400 FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400: Authorization Bypass Through User-Controlled Key

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2026-57114

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

Exploit for CVE-2026-12400

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modificatio...

WordPress FlowForms – Conversational Form Builder plugin <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification vulnerability

Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification vulnerability discovered by Aliyan Khan in WordPress Plugin FlowForms – Conversational Form Builder versions = 1.1.1...