CVE-2026-11995: Gutena Forms Authorization Bypass Flaw

CVE-2026-11995 Overview

CVE-2026-11995 is an authorization bypass vulnerability in the Gutena Forms WordPress plugin affecting all versions up to and including 1.9.0. The plugin exposes AJAX actions that modify form submission entries without properly verifying user authorization. Unauthenticated attackers can toggle the read/unread status of submissions or permanently trash arbitrary form entries belonging to any form on the site. The check_ajax_referer() nonce protecting these actions does not function as an authorization barrier because the gutena_Forms nonce action is emitted to unauthenticated visitors via wp_localize_script() on any public page containing a Gutena Forms block.

Critical Impact
Unauthenticated attackers can permanently trash arbitrary form submission entries, resulting in loss of customer inquiries, leads, and other business-critical form data collected by the plugin.

Affected Products

Gutena Forms plugin for WordPress — all versions ≤ 1.9.0
WordPress sites that publish any page containing a Gutena Forms block
Contact, survey, feedback, booking, and custom form deployments using Gutena Forms

Discovery Timeline

2026-08-01 - CVE-2026-11995 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-11995

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in the Gutena Forms plugin's submission management endpoints. The plugin registers AJAX handlers in includes/admin/class-manage-store.php that permit changing the read/unread state of submission entries and moving entries to the trash. These handlers rely solely on a nonce check to gate access. WordPress nonces are designed as CSRF tokens, not authorization mechanisms, and the plugin never checks the caller's role or capability before executing state-changing operations against stored entries.

Because the plugin does not enforce a capability check such as current_user_can('manage_options'), any request carrying a valid gutena_Forms nonce can invoke the destructive endpoints. Attackers do not need a valid WordPress account to reach these functions.

Root Cause

The root cause is broken access control at the AJAX handler layer. The functions registered in class-manage-store.php at lines 38, 53, and 62 execute privileged database operations after calling only check_ajax_referer(). Compounding this, gutena-forms.php at line 463 calls wp_localize_script() to emit the gutena_Forms nonce on every public page that renders a Gutena Forms block. This makes the nonce trivially retrievable by anonymous visitors via an HTTP GET request, defeating its purpose as any form of access control.

Attack Vector

An unauthenticated attacker locates a public page containing a Gutena Forms block and parses the page HTML to extract the gutena_Forms nonce value from the localized JavaScript object. The attacker then issues POST requests to admin-ajax.php targeting the vulnerable actions, supplying the harvested nonce and arbitrary submission entry identifiers. The server executes the requested trash or status-change operation against the specified entries without further checks. Iterating over entry identifiers permits mass destruction of stored form submissions.

No authentication, user interaction, or elevated privileges are required. Refer to the Wordfence Vulnerability Report and the WordPress Gutena Forms Manage Store source for technical details.

Detection Methods for CVE-2026-11995

Indicators of Compromise

Unexplained disappearance of Gutena Forms submission entries or entries appearing in the trash without administrator action.
POST requests to /wp-admin/admin-ajax.php referencing Gutena Forms manage-store actions originating from unauthenticated sessions or unfamiliar IP addresses.
Anonymous GET requests followed shortly by admin-ajax POST activity from the same source, indicating nonce harvesting behavior.

Detection Strategies

Enable WordPress query and access logging, then alert on admin-ajax.php calls that invoke Gutena Forms actions where the request lacks a valid authenticated session cookie.
Compare current form submission counts against historical baselines and alert on sudden deletions or bulk status changes.
Deploy a web application firewall rule that flags high-frequency requests to admin-ajax.php targeting Gutena Forms actions from a single client.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized log platform for correlation and long-term retention.
Monitor plugin database tables that back Gutena Forms submissions for anomalous DELETE or UPDATE volumes.
Track outbound WordPress admin activity from user roles that do not normally manage form submissions.

How to Mitigate CVE-2026-11995

Immediate Actions Required

Update the Gutena Forms plugin to a version later than 1.9.0 that includes the fix referenced in the Gutena Forms changeset 3624033.
If a patched version is not yet installed, deactivate the plugin until the update can be applied.
Audit existing form submission entries and restore any that were improperly trashed, using database backups if available.

Patch Information

The vendor addressed the flaw in a subsequent release tracked by WordPress plugin repository changeset 3624033. The fix adds capability checks to the affected AJAX handlers in includes/admin/class-manage-store.php so nonce validation is no longer the sole gate. Site operators should confirm the installed version is greater than 1.9.0 after updating.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the web application firewall to block unauthenticated requests that specify Gutena Forms action names.
Temporarily remove all Gutena Forms blocks from public-facing pages to prevent the gutena_Forms nonce from being exposed via wp_localize_script().
Increase database backup frequency for the tables storing form submissions until the patched plugin version is deployed.

bash

# Example WAF rule (ModSecurity) to block anonymous Gutena Forms AJAX calls
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1029995,msg:'Block unauth Gutena Forms AJAX'"
  SecRule ARGS:action "@rx ^gutena[_-]forms" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"