CVE-2026-16587 Overview
CVE-2026-16587 is an authorization bypass vulnerability [CWE-862] in the Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress. The flaw affects all versions up to and including 2.6.0. The plugin fails to verify that a user is authorized to perform sensitive actions tied to the MailUp integration. Authenticated attackers with subscriber-level access or above can overwrite the stored MailUp OAuth tokens in the adfoin_mailup_keys option. The vulnerability is triggerable through any authenticated visit to /wp-admin/profile.php, because admin_init fires for all logged-in users reaching any wp-admin page.
Critical Impact
Authenticated subscribers can hijack MailUp OAuth tokens, redirect form-submission data to an attacker-controlled MailUp account, or null the tokens to break the integration.
Affected Products
- Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress
- All versions up to and including 2.6.0
- WordPress sites with subscriber-or-higher user registration enabled
Discovery Timeline
- 2026-07-28 - CVE-2026-16587 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-16587
Vulnerability Analysis
The vulnerability resides in the MailUp integration module of the Advanced Form Integration plugin, specifically in platforms/mailup/mailup.php. Handler functions registered on the admin_init hook process incoming requests without verifying the caller's capability or intent. Because admin_init executes for every authenticated user visiting any /wp-admin/ page, the vulnerable code path is reachable by any logged-in user, including subscribers.
The attacker submits a request that reaches the MailUp token-handling logic while browsing a legitimate wp-admin URL such as profile.php. The handler writes attacker-supplied values directly into the adfoin_mailup_keys option. Subsequent form submissions processed by the plugin then push data to the MailUp account controlled by the attacker, or fail silently if the tokens were nulled.
Root Cause
The root cause is a missing authorization check [CWE-862]. The plugin does not call current_user_can() with an appropriate administrative capability, and it does not enforce a nonce check tied to an admin-only action. As a result, no server-side gate separates a subscriber's request from an administrator's request in this code path.
Attack Vector
Exploitation requires network access to the WordPress admin area and any authenticated account, including a self-registered subscriber on sites permitting open registration. The attacker crafts a request targeting the MailUp handler parameters and issues it while loading any wp-admin page. The plugin persists the supplied OAuth tokens into adfoin_mailup_keys, redirecting the integration's outbound data flow.
See the Wordfence Vulnerability Report and the vulnerable WordPress Plugin Code Snippet for the specific handler locations at lines 51, 98, 375, and 411.
Detection Methods for CVE-2026-16587
Indicators of Compromise
- Unexpected changes to the adfoin_mailup_keys option value in the WordPress wp_options table.
- MailUp OAuth access_token or refresh_token values that do not match the tokens issued to the site's legitimate MailUp account.
- Form submissions no longer appearing in the expected MailUp list, or appearing in an unknown MailUp tenant.
- HTTP requests to /wp-admin/profile.php or other wp-admin URLs from low-privilege user sessions carrying MailUp-related parameters.
Detection Strategies
- Audit the wp_options table for modifications to adfoin_mailup_keys and correlate changes against administrator activity.
- Enable WordPress action and option-update logging to capture the user ID performing writes to plugin options.
- Review web server access logs for subscriber-level accounts issuing requests to /wp-admin/ endpoints with MailUp handler parameters.
Monitoring Recommendations
- Alert on writes to adfoin_mailup_keys originating from non-administrator user IDs.
- Monitor for anomalous outbound API calls from the WordPress host to api.mailup.com endpoints not associated with the configured account.
- Track newly registered subscriber accounts followed by immediate wp-admin activity.
How to Mitigate CVE-2026-16587
Immediate Actions Required
- Update the Advanced Form Integration plugin to a version later than 2.6.0 that includes the fix referenced in the WordPress Plugin Changeset.
- Rotate the MailUp OAuth credentials and reauthorize the integration to invalidate any tokens that may have been overwritten.
- Audit user accounts and remove any unrecognized subscriber-level registrations.
Patch Information
The vendor addressed the issue in the changeset published on the WordPress plugin repository. Site operators should upgrade to the fixed release available through the WordPress plugin update mechanism. Review the vulnerable code paths at lines 51, 98, 375, and 411 of platforms/mailup/mailup.php in the 2.6.0 tag to confirm the fix version deployed in the environment.
Workarounds
- Deactivate the Advanced Form Integration plugin until an upgrade is applied if MailUp integration is not in use.
- Disable public user registration by unchecking "Anyone can register" in WordPress General Settings to reduce the exploit population.
- Restrict wp-admin access at the web server or WAF layer to trusted IP ranges for non-administrator accounts.
- Remove the adfoin_mailup_keys option after uninstall to prevent stale tokens from being reused.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
