Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR
Priority MEDIUM 42CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.
Summary
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Why it matters now
EPSS 0.01857 79th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Advanced Forms Ppro (TODO): 1.6.9Advanced Forms (TODO): 1.6.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TODO | Advanced Forms Ppro | 1.6.9 to before 1.6.9 | 1.6.9 | Patch available | CNA |
| TODO | Advanced Forms | 1.6.9 to before 1.6.9 | 1.6.9 | Patch available | CNA |
- Advanced Forms Ppro VendorTODO Affected 1.6.9 to before 1.6.9 Fixed in 1.6.9 Patch available CNA
- Advanced Forms VendorTODO Affected 1.6.9 to before 1.6.9 Fixed in 1.6.9 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:advanced_forms_project:advanced_forms:*:*:*:*:free:wordpress:*:* | before 1.6.9 | Vulnerable | Advanced Forms Project |
| cpe:2.3:a:advanced_forms_project:advanced_forms:*:*:*:*:pro:wordpress:*:* | before 1.6.9 | Vulnerable | Advanced Forms Project |
- cpe:2.3:a:advanced_forms_project:advanced_forms:*:*:*:*:free:wordpress:*:* Versions before 1.6.9 Vulnerable ·Advanced Forms Project
- cpe:2.3:a:advanced_forms_project:advanced_forms:*:*:*:*:pro:wordpress:*:* Versions before 1.6.9 Vulnerable ·Advanced Forms Project
Remediation
- Fix · CNA Advanced Forms Ppro (TODO) Fixed in 1.6.9
- Fix · CNA Advanced Forms (TODO) Fixed in 1.6.9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24892
- 2026-10-03 Alias added: GHSA-p5hv-vfxr-c3g7
References
Sources
- CVE-2021-24892 · CVE Program
- CVE-2021-24892 · NVD
- FIRST EPSS
- GHSA-p5hv-vfxr-c3g7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences