CVE-2026-7050

Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.

Analysis

AI-generated

Technical impact

The Forms Rb plugin fails to verify that a user is authorized to execute actions that involve the form_id parameter. This bug allows any authenticated user with at least Contributor level to view all form submission records, alter form configuration settings, and delete records belonging to forms that the user does not own. The impact is a loss of confidentiality, integrity, and partial control over the content of the site, without affecting system availability.

Affected Systems

All installations of the Forms Rb WordPress plugin up to version 1.1.9 are vulnerable. The affected product is the Forms Rb plugin from rbplugins, which is installed within a WordPress site.

Risk and Exploitability

The CVSS v3.1 score of 4.3 indicates a moderate severity. No EPSS score is available, so the exploitation probability cannot be quantified, but the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via the web application; an attacker only needs an authenticated Contributor+ user account, which narrows the target to sites that grant such roles but have not applied an update.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Forms Rb plugin to the latest released version that contains the authorization checks.
  • If an immediate upgrade is not possible, remove Contributor+ capability from any users who do not require it, or restrict access to the plugin’s administrative pages via WordPress role management.
  • Use site‑wide anti‑CSRF and role‑based access controls in general, and verify all plugin installs are kept current by regularly reviewing vendor releases.

Generated by OpenCVE AI on May 12, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Rbplugins
Rbplugins forms Rb
Wordpress
Wordpress wordpress
Vendors & Products Rbplugins
Rbplugins forms Rb
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Forms Rb plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to read form submission records, modify form configuration options, and delete records belonging to any form they do not own.
Title Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
May 12, 2026, 4:49 PM
Reserved
Apr 25, 2026, 5:55 PM

View source JSON

Updated
May 12, 2026, 4:49 PM

JSON

Status
Deferred
Published
May 12, 2026, 9:16 AM
Modified
Jun 17, 2026, 11:01 AM

View source JSON

No data.

Updated
May 13, 2026, 10:39 AM

JSON