priyanshuchaudhary FlowForms Plugin up to 1.1.1 on WordPress Form Update update_form form_id resource injection

Summaryinfo

A vulnerability labeled as critical has been found in priyanshuchaudhary FlowForms Plugin up to 1.1.1. The impacted element is the function update_form of the component Form Update Handler. Such manipulation of the argument form_id leads to resource injection. This vulnerability is referenced as CVE-2026-12400. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in priyanshuchaudhary FlowForms Plugin up to 1.1.1. It has been rated as critical. Affected by this issue is the function update_form of the component Form Update Handler. The manipulation of the argument form_id with an unknown input leads to a resource injection vulnerability. Using CWE to declare the problem leads to CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.

The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-12400 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/10/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• priyanshuchaudhary

Name

• FlowForms Plugin

Version

• 1.1.0
• 1.1.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion