CVE-2026-11995 Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

MINI-65VQ-57QJ-GHR8

Bulletin has no description...

MINI-PQ5X-FJCQ-X829

Bulletin has no description...

WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash vulnerability

Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash vulnerability discovered by Endang Alfarisi in WordPress Plugin Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions = 1.9.0...

CGA-V4XJ-XGV4-X468

Bulletin has no description...

CGA-9XCV-VM5R-3Q8V

Bulletin has no description...

MINI-G9FX-GXR6-52CV

Bulletin has no description...

MINI-99X9-2VH5-6W79

Bulletin has no description...

MINI-HCVP-H54C-FCGQ

Bulletin has no description...

MINI-VX28-5GRC-HP4W

Bulletin has no description...

MINI-287H-JP76-9J59

Bulletin has no description...

MINI-WWG5-QCC3-7V9V

Bulletin has no description...

ECHO-6029-E204-9F0D

Bulletin has no description...

ECHO-BD78-D653-225E

Bulletin has no description...

ECHO-5D48-3D7F-704D

Bulletin has no description...

ECHO-E107-0C49-F8EA

Bulletin has no description...

ECHO-136D-5B24-3C6E

Bulletin has no description...

ECHO-4FE1-0166-DEAD

Bulletin has no description...

ECHO-A71A-6275-1DFC

Bulletin has no description...

CVE-2026-51293

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...