FlowForms – Conversational Form Builder for WordPress contains an Insecure Direct Object Reference flaw (CWE‑639). The update_form handler fails to validate that the caller owns the form or has sufficient privileges, allowing an authenticated user with Contributor level access or higher to send requests to the REST endpoint /flowforms/v1/forms/{id}. An attacker can then alter the form’s content, the user experience, and potentially inject malicious data.

All WordPress sites running FlowForms version 1.1.1 or earlier from the vendor priyanshuchaudhary are affected. The vulnerability applies to every instance where a higher role is granted access.

The CVSS score of 4.3 denotes a low‑medium severity, and the EPSS score of less than 1 % indicates a low probability of exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with at least Contributor privileges. By supplying an arbitrary form ID in the REST URL, the attacker can modify any form on the site, regardless of ownership.