CVE-2026-8692

Vulnerability

The Vedrixa Forms plugin for WordPress versions up to and including 1.1.1 contains an authorization bypass vulnerability in its AJAX handler responsible for saving form structure. The plugin fails to verify that the requesting user has the necessary capabilities (e.g., edit_posts or manage_options) before processing the request. Additionally, the ajax-nonce used to protect the handler is exposed on public-facing pages via wp_localize_script(), making it accessible to any authenticated user who visits a page containing a form shortcode [1][3].

Exploitation

An authenticated attacker with subscriber-level access or higher can obtain the nonce by simply visiting any page that displays a form built with the plugin. The attacker then sends a crafted AJAX request to the vulnerable handler, supplying the nonce and arbitrary form field data. The handler writes this data directly to the plugin's FORMS database table without any capability check, allowing the attacker to add, modify, or delete fields in any existing form [1].

Impact

Successful exploitation allows an attacker to alter the structure of any form managed by the plugin. This can lead to data integrity issues, as form fields can be changed to collect unintended information, or fields can be removed causing data loss. The attacker does not gain administrative privileges but can compromise the functionality and trustworthiness of forms used on the site.

Mitigation

As of the publication date (2026-05-22), no fixed version has been released. Users should disable the plugin until a patch is available. The vendor has not yet provided a workaround. The vulnerability affects all versions up to 1.1.1 inclusive [1][3].