CVE-2026-12400: FlowForms WordPress IDOR Vulnerability

CVE-2026-12400 Overview

CVE-2026-12400 is an Insecure Direct Object Reference (IDOR) vulnerability in the FlowForms – Conversational Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.1.1. The issue resides in the update_form REST API handler, which fails to validate a user-controlled key. Authenticated attackers with contributor-level access or higher can supply an arbitrary form ID in the REST URL to modify content, design, and settings of any form on the site. Attackers can also publish or revert forms owned by administrators. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Contributor-level accounts can tamper with, publish, or revert any form on the site, including administrator-owned forms.

Affected Products

FlowForms – Conversational Form Builder plugin for WordPress
All versions up to and including 1.1.1
WordPress sites permitting contributor-level user registration

Discovery Timeline

2026-07-10 - CVE-2026-12400 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-12400

Vulnerability Analysis

The FlowForms plugin exposes REST API endpoints through its class-rest-api.php module for form management operations. The update_form endpoint accepts a form identifier supplied by the client but does not verify that the requesting user owns the referenced form or holds sufficient capability to modify it. As a result, the endpoint honors any valid form ID passed in the request, regardless of ownership.

A contributor-level user who has legitimate access to author their own forms can substitute another form's ID in the REST URL. The server applies the requested changes to the target form. This allows tampering with form content, changing design and settings, and toggling publish or revert states on administrator-owned forms. The attack requires only low privileges and no user interaction.

Root Cause

The root cause is missing authorization enforcement on a user-controlled object identifier. The REST route registered in class-rest-api.php validates authentication but does not perform a per-object capability check tying the calling user to the form referenced by the ID parameter. This design pattern matches CWE-639, where object references are exposed to users without verifying they are authorized to act on the referenced object.

Attack Vector

Exploitation occurs over the network against the WordPress REST API. An attacker authenticates with a contributor account, then issues a request to the FlowForms update_form REST endpoint with a target form ID belonging to another user. The server executes the modification. See the Wordfence advisory and the FlowForms REST API source for the affected code paths. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-12400

Indicators of Compromise

Unexpected changes to form content, layout, or settings on WordPress sites running FlowForms <= 1.1.1.
Forms owned by administrators being published or reverted by low-privileged accounts.
REST API requests to FlowForms update_form endpoints originating from contributor accounts referencing form IDs the account does not own.

Detection Strategies

Enable WordPress REST API request logging and correlate update_form calls with the acting user's owned form IDs.
Audit the wp_posts table and FlowForms metadata for form modification timestamps that do not align with owner activity.
Alert on privilege-role mismatches when a contributor account modifies content associated with an administrator user ID.

Monitoring Recommendations

Forward WordPress and web server logs into a centralized data lake for correlation of REST API activity with user roles.
Baseline normal form authoring behavior per user and flag anomalous cross-owner writes.
Track new contributor account registrations followed by REST API calls to /wp-json/flowforms/ routes.

How to Mitigate CVE-2026-12400

Immediate Actions Required

Update the FlowForms – Conversational Form Builder plugin to a version later than 1.1.1 once the vendor patch is available.
Restrict or disable contributor-level user registration until the plugin is patched.
Review all forms for unauthorized modifications and restore known-good versions from backups.

Patch Information

The vendor committed a fix in the FlowForms plugin repository. Review the FlowForms change set for the corrective code. Administrators should upgrade to the fixed release published to the WordPress plugin directory and confirm the installed version is greater than 1.1.1.

Workarounds

Deactivate the FlowForms plugin until the patched version is deployed.
Remove contributor and author role assignments from untrusted users to reduce the attack surface.
Apply a web application firewall rule to block REST requests to FlowForms update_form routes where the referenced form ID does not belong to the authenticated user.

bash

# Verify installed FlowForms version via WP-CLI
wp plugin get flowforms --field=version

# Deactivate the plugin as a temporary mitigation
wp plugin deactivate flowforms

# Update once a fixed release is available
wp plugin update flowforms