CVE-2026-1753
Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update
- State
- Published
- Severity
- 6.8 Medium
- Published
- Mar 11, 2026
- Updated
- Mar 11, 2026
- Reserved
- Feb 2, 2026
Description
The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Gutena FormsUnknown |
|
References
- https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.