CVE-2026-74004 Overview
CVE-2026-74004 is a broken access control vulnerability in the Gravity Booster – Styles & Layouts for Gravity Forms WordPress plugin, affecting versions up to and including 6.0. The flaw allows authenticated users at the Subscriber role to access functionality that should be restricted to higher-privileged accounts. The issue maps to CWE-862: Missing Authorization and requires low privileges to exploit over the network without user interaction. Confidentiality and integrity impacts are rated Low, and no availability impact is reported.
Critical Impact
Any authenticated Subscriber on a WordPress site running Gravity Booster – Styles & Layouts for Gravity Forms 6.0 or earlier can invoke plugin actions outside their intended permission boundary.
Affected Products
- Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress
- Versions less than or equal to 6.0
- WordPress sites permitting Subscriber-level registration
Discovery Timeline
- 2026-08-18 - CVE-2026-74004 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-74004
Vulnerability Analysis
The vulnerability is a broken access control issue classified under CWE-862: Missing Authorization. The plugin exposes one or more actions that fail to verify the caller's capability or role before executing. As a result, users authenticated at the lowest WordPress privilege tier, Subscriber, can reach functionality intended for administrators or form managers.
The attack vector is network-based and requires only Subscriber-level credentials. No user interaction is needed, and the exploit does not cross a security scope boundary. Because many WordPress deployments allow open user registration or expose Subscriber accounts through membership plugins, the pool of potential attackers on affected sites is broad.
Successful exploitation yields limited information disclosure and limited data tampering within the plugin's scope. Availability of the site is not affected. Refer to the Patchstack advisory for vendor-specific technical details.
Root Cause
The root cause is missing authorization checks on one or more plugin endpoints. WordPress plugins typically enforce access using current_user_can() capability checks and nonce validation via check_ajax_referer() or wp_verify_nonce(). In this plugin, at least one action handler lacks these checks or performs them incorrectly, permitting a Subscriber to invoke privileged operations.
Attack Vector
An attacker registers or authenticates as a Subscriber on a target WordPress site running an affected version. The attacker then issues a crafted HTTP request to the vulnerable plugin endpoint. Because the endpoint does not enforce role or capability restrictions, the request executes as if issued by a permitted user, returning restricted data or modifying plugin state.
No verified public exploit code is available at this time. See the Patchstack advisory for further technical detail.
Detection Methods for CVE-2026-74004
Indicators of Compromise
- Requests to admin-ajax.php or plugin REST routes from accounts holding only the subscriber role.
- Unexpected modifications to Gravity Forms styling, layout, or configuration data authored by non-administrator accounts.
- New or recently active Subscriber accounts issuing bursts of authenticated requests to plugin endpoints.
Detection Strategies
- Correlate WordPress access logs with user role metadata to flag Subscriber requests to plugin admin actions.
- Enable WordPress audit logging to record option changes, post meta updates, and plugin setting writes with associated user context.
- Compare current plugin settings and form styles against a known-good baseline to identify unauthorized changes.
Monitoring Recommendations
- Alert on HTTP 200 responses to admin-ajax.php actions containing gwstyles, gravity, or plugin-specific action names when initiated by low-privilege users.
- Monitor for spikes in new user registrations followed by authenticated POST requests to plugin endpoints.
- Track plugin version inventory across all managed WordPress sites and flag installations at version 6.0 or lower.
How to Mitigate CVE-2026-74004
Immediate Actions Required
- Update Gravity Booster – Styles & Layouts for Gravity Forms to a version newer than 6.0 once a patched release is available from the vendor.
- Audit all Subscriber and low-privilege accounts for legitimacy and remove unrecognized users.
- Disable open user registration on WordPress sites that do not require it by unchecking Anyone can register under Settings > General.
Patch Information
Consult the Patchstack advisory for CVE-2026-74004 for current patch availability and version guidance. Apply the fixed release from the plugin vendor as soon as it is published.
Workarounds
- Deactivate the Gravity Booster – Styles & Layouts for Gravity Forms plugin until a fixed version is installed.
- Deploy a web application firewall rule to block Subscriber-authenticated requests to the plugin's AJAX and REST endpoints.
- Restrict WordPress user registration or gate new accounts through an approval workflow to reduce the attacker pool.
# Configuration example: disable open registration via wp-cli
wp option update users_can_register 0
# List and review Subscriber accounts
wp user list --role=subscriber --fields=ID,user_login,user_registered,user_email
# Deactivate the affected plugin until patched
wp plugin deactivate styles-and-layouts-for-gravity-forms
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
