CVE-2026-11794

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2026-07-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/614b9517-d6d5-499f-8172-280280a312b2/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1179
• CVE-2026-11801
• CVE-2026-11784
• CVE-2026-1182
• CVE-2026-11782
• CVE-2026-11827