What the vulnerability does
01Description
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.
Explanation of Vulnerability in Simple Terms
02Summary
Advanced Form Integration versions 2.6.0 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify data they should not have access to. The vulnerability requires an active user account but no special interaction from the victim. Update to a version newer than 2.6.0 to resolve this issue.
What an attacker can do
03Attacker Capabilities
A low-privilege user can modify data they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users may alter form data or settings, compromising data integrity and form functionality.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low privileges on the site.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 28, 2026
Record updated
