CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modification Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification in FlowForms ≤ 1.1.1 Vulnerability Overview...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms 未授权表单发布 已认证（贡献者及以上）授权绕过，可在 FlowForms ≤ 1.1.1 中发布任意草稿表单 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-11991 CVSS 评分| 6.2 — 中危 CVSS 向量| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C CWE| CWE-639（通过用户可控密钥绕过授权） 产品| FlowForms — WordPress 对话式表单构建插件 受影响版本| 所有版本，最高至 1.1.1 修复版本| 1.1.2...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-42847

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400 FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the updateform due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-12400

FlowForms (WordPress plugin)

WordPress FlowForms – Conversational Form Builder plugin <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification vulnerability

Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification vulnerability discovered by Aliyan Khan in WordPress Plugin FlowForms – Conversational Form Builder versions = 1.1.1...