CVE-2026-28571: FormyChat Auth Bypass Vulnerability

CVE-2026-28571 Overview

CVE-2026-28571 is an unauthenticated broken access control vulnerability affecting the FormyChat WordPress plugin in versions up to and including 2.15.7. The flaw stems from missing authorization checks [CWE-862] on plugin functionality, allowing remote attackers to reach protected operations without valid credentials. Because the issue is reachable over the network with no authentication or user interaction, exploitation requires only HTTP access to a vulnerable WordPress site. Public reporting attributes the disclosure to the Patchstack vulnerability database. Site operators running the affected plugin should treat the exposure as remediation-priority given the low attack complexity.

Critical Impact
Unauthenticated remote attackers can bypass access control in FormyChat <= 2.15.7, exposing confidential plugin data or actions on affected WordPress sites.

Affected Products

FormyChat (Social Contact Form) WordPress plugin versions <= 2.15.7
WordPress sites with the FormyChat plugin installed and network-reachable
Any environment shipping the vulnerable plugin bundle

Discovery Timeline

2026-08-18 - CVE-2026-28571 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-28571

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness [CWE-862] in the FormyChat plugin. The plugin exposes functionality that should be restricted to authenticated or privileged users but does not enforce a capability or nonce check before executing the requested action. An attacker sends a crafted HTTP request to the vulnerable endpoint and reaches server-side logic that assumes the caller has already been authorized.

The CVSS vector indicates a confidentiality impact only, with no direct effect on integrity or availability. In practical terms, unauthenticated actors can read data that the plugin was intended to keep private, such as form configurations, chat records, or integration metadata. The EPSS score is low, suggesting limited observed exploitation activity at publication time, but the low complexity of missing-authorization bugs typically leads to rapid weaponization once details are public.

Root Cause

The root cause is the absence of an authorization gate on one or more plugin request handlers. In WordPress plugins this pattern typically appears when an AJAX action registered with wp_ajax_nopriv_ (or a REST route with a permissive permission_callback) invokes privileged logic without calling current_user_can() or verifying a nonce with check_ajax_referer().

Attack Vector

Exploitation occurs over the network against a WordPress site running FormyChat <= 2.15.7. The attacker issues an HTTP request to the affected plugin endpoint. No credentials, session, or user interaction are required. Because the request path is standard WordPress AJAX or REST traffic, exploitation blends with normal application traffic and is difficult to distinguish without endpoint-level authorization logging.

For technical details, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-28571

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to FormyChat AJAX actions under /wp-admin/admin-ajax.php or plugin REST routes under /wp-json/.
Requests to plugin endpoints originating from IP addresses with no prior authenticated session cookie.
Anomalous response sizes returned to unauthenticated clients from plugin handlers that normally serve administrators.

Detection Strategies

Inventory WordPress installations and flag any host running the FormyChat plugin at version 2.15.7 or earlier.
Inspect web server and WordPress access logs for requests to FormyChat actions that lack a valid wordpress_logged_in_* cookie.
Enable Patchstack, Wordfence, or equivalent WordPress vulnerability feeds to correlate installed plugin versions against published CVEs.

Monitoring Recommendations

Alert on spikes of requests to admin-ajax.php with plugin-specific action parameters from a single source.
Monitor REST API traffic to plugin namespaces for unauthenticated 200-status responses.
Track plugin file integrity and version metadata via configuration management to detect stale or vulnerable installs.

How to Mitigate CVE-2026-28571

Immediate Actions Required

Upgrade the FormyChat plugin to a version later than 2.15.7 as soon as a fixed release is available from the vendor.
Audit the site for unexpected data access or exfiltration performed through the plugin endpoints while the vulnerability was exposed.
Restrict administrative and plugin endpoints behind a web application firewall (WAF) with virtual patching rules for CVE-2026-28571.

Patch Information

Refer to the Patchstack Vulnerability Report for the authoritative fixed version and vendor advisory. Update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Confirm the installed version matches the fixed release after applying the update.

Workarounds

Deactivate and remove the FormyChat plugin until a patched version is installed if the plugin is not business-critical.
Apply WAF rules that block unauthenticated requests to FormyChat AJAX actions and REST routes.
Restrict access to /wp-admin/admin-ajax.php and plugin REST namespaces to known IP ranges where operationally feasible.

bash

# Configuration example: block unauthenticated access to FormyChat endpoints at the reverse proxy
# Nginx snippet - adjust action names to match FormyChat handlers identified in the advisory
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^formychat_") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}