Gutena Forms Plugin up to 1.6.0 on WordPress save_gutena_forms_schema authorization

Summaryinfo

A vulnerability labeled as problematic has been found in Gutena Forms Plugin up to 1.6.0 on WordPress. This affects the function save_gutena_forms_schema. Such manipulation leads to authorization. This vulnerability is referenced as CVE-2026-1674. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Gutena Forms Plugin up to 1.6.0 on WordPress. Affected by this issue is the function save_gutena_forms_schema. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled.

The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-1674. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9389). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• Gutena Forms Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion