CVE-2026-1674: Gutena Forms Auth Bypass Vulnerability

CVE-2026-1674 Overview

The Gutena Forms plugin for WordPress, a popular form builder supporting contact forms, survey forms, feedback forms, booking forms, and custom forms, contains a critical authorization bypass vulnerability. The flaw exists within the save_gutena_forms_schema() function, which fails to implement proper capability checks, allowing authenticated attackers with Contributor-level access or above to modify arbitrary WordPress option values.

Critical Impact

Authenticated attackers can leverage this vulnerability to modify site options, potentially enabling user registration on sites where it was explicitly disabled, or causing denial of service by corrupting critical configuration values.

Affected Products

• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress versions up to and including 1.6.0

Discovery Timeline

• 2026-03-04 - CVE CVE-2026-1674 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-1674

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a fundamental access control flaw where the application fails to verify that a user is authorized to perform a specific action. The save_gutena_forms_schema() function processes form schema save requests without implementing proper WordPress capability checks or nonce verification.

The impact of this vulnerability extends beyond simple data modification. Attackers can set option values to structured array values, which can have cascading effects across the WordPress installation. For instance, modifying the users_can_register option would allow public user registration, potentially enabling further privilege escalation attacks. Similarly, corrupting critical options could render the site unusable, effectively causing a denial of service condition.

Root Cause

The root cause lies in missing authorization checks within the save_gutena_forms_schema() function. WordPress plugins that modify site options must implement proper capability verification using functions like current_user_can() to ensure only administrators or users with appropriate permissions can execute sensitive operations. The vulnerable code path allows any authenticated user with at least Contributor-level access to bypass these restrictions entirely.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with Contributor privileges or higher. An attacker would craft a malicious request targeting the vulnerable function to modify WordPress options. The attack does not require user interaction and can be automated once valid credentials are obtained.

The attacker sends a crafted POST request to the WordPress AJAX handler targeting the save_gutena_forms_schema action. Because the function lacks authorization checks, the request is processed regardless of the user's actual capabilities, allowing arbitrary option modification with structured array values. Technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1674

Indicators of Compromise

• Unexpected modifications to WordPress options, particularly users_can_register, default_role, or other critical site configuration values
• Unusual AJAX requests to admin-ajax.php with the save_gutena_forms_schema action from low-privilege users
• New user registrations appearing when registration was supposed to be disabled
• Site configuration changes without corresponding administrator activity in audit logs

Detection Strategies

• Monitor WordPress audit logs for option modifications not associated with administrator sessions
• Implement Web Application Firewall (WAF) rules to detect suspicious AJAX requests targeting form plugin endpoints
• Review access logs for repeated requests to admin-ajax.php from authenticated sessions with unusual patterns
• Deploy file integrity monitoring to detect unauthorized changes to plugin files

Monitoring Recommendations

• Enable detailed logging for WordPress option changes using a security plugin or custom logging solution
• Configure alerts for modifications to security-sensitive options like user registration settings
• Monitor for new user account creation events, especially when public registration is intended to be disabled
• Implement real-time alerting for configuration drift on production WordPress installations

How to Mitigate CVE-2026-1674

Immediate Actions Required

• Update the Gutena Forms plugin to a patched version immediately
• Review WordPress options for unexpected modifications, particularly user registration and role settings
• Audit user accounts for any unauthorized registrations that may have occurred during the exposure window
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

A security patch addressing this vulnerability has been released. The fix can be reviewed in the WordPress Changeset Update. Site administrators should update to the latest version of Gutena Forms through the WordPress plugin update mechanism. Verify the update was successful by checking the plugin version in the WordPress admin panel.

Workarounds

• Temporarily deactivate the Gutena Forms plugin until the update can be applied
• Restrict Contributor-level access to trusted users only until patched
• Implement a Web Application Firewall rule to block requests to the vulnerable endpoint
• Use a WordPress security plugin to add additional authorization checks at the AJAX handler level

# Verify current Gutena Forms plugin version
wp plugin list --name=gutena-forms --fields=name,version,update_version

# Update the plugin to the latest version
wp plugin update gutena-forms

# Verify critical WordPress options have not been tampered with
wp option get users_can_register
wp option get default_role