CVE-2026-12400
FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints
MEDIUM 4.3EPSS 0.4%
The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.
- Affected
- priyanshuchaudhary · FlowForms – Conversational Form Builder
- CVSS v3.1 WORDFENCE
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.37% chance of exploitation in the next 30 days, 29th percentile
- Published
- 2026-07-10
- Updated
- 2026-07-14
Proof-of-concept exploits (1)
- 0x00phantom-hat/CVE-2026-12400-Exploit1★ · 2026-07-09