CVE-2026-12853: Flamingo WordPress Plugin Auth Bypass

CVE-2026-12853 Overview

CVE-2026-12853 is an authorization bypass vulnerability in the Flamingo plugin for WordPress, affecting all versions up to and including 2.6.2. The plugin fails to properly verify user authorization for taxonomy-related actions. Authenticated attackers with contributor-level access or higher can enumerate taxonomy terms, including channel names derived from Contact Form 7 form titles, submission counts per channel, and contact tag names. Exposed metadata may reveal internal form purposes, department names, and workflow identifiers. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact

Authenticated low-privilege users can enumerate internal Contact Form 7 channel names, tag names, and submission counts, exposing sensitive operational metadata.

Affected Products

• Flamingo plugin for WordPress, versions ≤ 2.6.2
• WordPress sites using Flamingo alongside Contact Form 7
• Multi-author WordPress deployments granting contributor-level roles

Discovery Timeline

• 2026-09-07 - CVE-2026-12853 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-12853

Vulnerability Analysis

The Flamingo plugin stores messages and contacts submitted through Contact Form 7 using WordPress custom post types and custom taxonomies. Flamingo channels and tags are implemented as taxonomy terms attached to those post types. The plugin ships a flamingo_map_meta_cap() filter to restrict who can access the Flamingo administrative interface. That filter, however, only governs Flamingo's own admin screens.

The filter does not extend authorization checks to WordPress core APIs that operate on the same taxonomies. As a result, an authenticated contributor can bypass the intended access boundary and read term data through channels the plugin author did not anticipate. The exposed data reveals form titles used internally, tag names applied to contacts, and per-channel submission counts.

Root Cause

The root cause is an incomplete authorization model. Flamingo enforces capability checks only in its administrative UI paths and relies on obscurity for its underlying taxonomies. Because the taxonomies are registered in a way that permits querying through core WordPress interfaces, any authenticated user with sufficient rights to invoke those interfaces can retrieve term data without triggering the plugin's capability filter.

Attack Vector

Exploitation requires network access and authenticated contributor-level credentials or higher. An attacker calls the WordPress XML-RPC method wp.getTerms or the admin-ajax endpoint ajax-tag-search against Flamingo's taxonomies. These core APIs return the taxonomy terms, term counts, and tag names directly. No user interaction is required and no code execution results. The impact is limited to confidentiality of operational metadata.

See the Wordfence Vulnerability Report and the Flamingo capability code in 2.6.2 for the technical mechanism.

Detection Methods for CVE-2026-12853

Indicators of Compromise

• XML-RPC requests from authenticated contributor accounts invoking wp.getTerms against Flamingo taxonomies.
• admin-ajax.php requests with the action=ajax-tag-search parameter referencing Flamingo taxonomy names.
• Unusual enumeration patterns from contributor or author accounts that do not typically interact with contact form data.

Detection Strategies

• Review WordPress access logs for xmlrpc.php POST requests containing wp.getTerms calls.
• Alert on admin-ajax.php requests where the action parameter equals ajax-tag-search and the taxonomy parameter references Flamingo-registered taxonomies.
• Correlate authenticated session identifiers with sudden bursts of taxonomy queries to identify enumeration behavior.

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for behavioral baselining of authenticated users.
• Track the Flamingo plugin version across all managed WordPress sites and alert when versions ≤ 2.6.2 are detected.
• Monitor role assignments and flag unexpected escalations to contributor or higher roles.

How to Mitigate CVE-2026-12853

Immediate Actions Required

• Update the Flamingo plugin to a version above 2.6.2 that includes the fix from Flamingo Changeset 3611179.
• Audit WordPress user accounts and remove contributor-level or higher access that is no longer required.
• Disable XML-RPC on WordPress installations that do not require it, either through a security plugin or web server configuration.

Patch Information

The vendor addressed the missing authorization in a release following 2.6.2. The fix is documented in Flamingo Changeset 3611179. Site operators should apply the plugin update through the WordPress administrative interface or the wp-cli command line. Verify the installed version after upgrade and clear any object caches.

Workarounds

• Block or restrict access to xmlrpc.php at the web server or web application firewall layer.
• Restrict access to admin-ajax.php actions from low-privilege roles using a capability-management plugin.
• Temporarily reduce Contact Form 7 form titles and Flamingo tag names so they do not reveal sensitive internal identifiers.

# Example nginx configuration to block xmlrpc.php
location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 403;
}