CVE-2026-1674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1674", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-30T01:38:03.875Z", "datePublished": "2026-03-04T11:22:30.508Z", "dateUpdated": "2026-04-08T16:51:02.597Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:02.597Z"}, "affected": [{"vendor": "saadiqbal", "product": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled."}], "title": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc10693-6d7c-4293-8848-02181ceb0d25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463148/gutena-forms"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "timeline": [{"time": "2026-01-30T01:54:50.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-03T21:42:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T15:00:49.809121Z", "id": "CVE-2026-1674", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T15:00:56.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1674", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T15:00:49.809121Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T15:00:52.920Z"}}], "cna": {"title": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()", "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "saadiqbal", "product": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-30T01:54:50.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-03T21:42:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc10693-6d7c-4293-8848-02181ceb0d25?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463148/gutena-forms"}], "descriptions": [{"lang": "en", "value": "The Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:02.597Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1674", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:02.597Z", "dateReserved": "2026-01-30T01:38:03.875Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-04T11:22:30.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder", "vendor": "saadiqbal", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled."}, {"lang": "es", "value": "El plugin Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, y Custom Form Builder para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de autorizaci\u00f3n dentro de la funci\u00f3n save_gutena_forms_schema() en todas las versiones hasta la 1.6.0, inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, actualicen los valores de las opciones a un valor de array estructurado en el sitio de WordPress. Esto puede ser aprovechado para actualizar una opci\u00f3n que crear\u00eda un error en el sitio y denegar el servicio a usuarios leg\u00edtimos o ser usado para establecer algunos valores que, por ejemplo, habilitar\u00edan el registro de usuarios del sitio cuando est\u00e1 expl\u00edcitamente deshabilitado."}], "id": "CVE-2026-1674", "lastModified": "2026-06-17T10:16:17.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1674", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T15:00:49.809121Z", "version": "2.0.3"}}]}, "published": "2026-03-04T12:16:02.733", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3463148/gutena-forms"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc10693-6d7c-4293-8848-02181ceb0d25?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder", "source": "cna", "vendor": "saadiqbal"}, "product": "gutena_forms_\u2013_contact_form,_survey_form,_feedback_form,_booking_form,_and_custom_form_builder", "vendor": "saadiqbal"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:56:08.652410+00:00", "value": {"mitigation_remediation": ["Upgrade the Gutena Forms plugin to a version newer than 1.6.0, which addresses the missing authorization check.", "Restrict Contributor and higher users from accessing the form schema editing functionality by assigning lower capabilities or limiting role permissions.", "If an upgrade cannot be performed immediately, disable the form management page or uninstall the plugin until a patched version is available."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized modification of Gutena Forms plugin options, enabling site configuration changes or denial of service."}, "threat_synthesis": {"affected_systems": "All WordPress sites running Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions 1.6.0 or earlier are vulnerable. The risk applies to users with Contributor role or higher access who can edit form settings.", "description_and_impact": "The Gutena Forms WordPress plugin is affected by a missing authorization check in the save_gutena_forms_schema() function. Attackers who have Contributor-level access or higher can modify form schema settings. This enables them to change options such as site registration or create configuration errors that deny service to legitimate users. The flaw allows unauthorized data modification that impacts the website\u2019s configuration and functionality.", "risk_and_exploitability": "The CVSS score of 6.5 classifies the vulnerability as medium severity. EPSS <1% indicates a low probability of exploitation. The issue is not listed in the KEV catalog. Exploitation requires an authenticated contributor or higher role in WordPress; the attacker can then adjust plugin options to cause a site outage or enable unwanted feature settings."}}}}, "created": "2026-03-04T21:03:40.854552+00:00", "updated": "2026-04-15T18:00:15.503030+00:00", "vendors": ["saadiqbal", "saadiqbal$PRODUCT$gutena_forms_\u2013_contact_form,_survey_form,_feedback_form,_booking_form,_and_custom_form_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}