What the vulnerability does
01Description
The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.
Explanation of Vulnerability in Simple Terms
02Summary
FlowForms versions 1.1.1 and earlier contain an authorization flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account and network access but no additional user interaction. Site administrators should update to a version newer than 1.1.1 to prevent unauthorized data modification.
What an attacker can do
03Attacker Capabilities
Modify data or settings they lack authorization to change.
Potential impact on your site
04Site Impact
Authenticated users can alter form data or settings beyond their intended permissions.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site.
Key dates
06Disclosure timeline
July 10, 2026
CVE published
