Missing authorization in nasirahmed Advanced Form Integration — Connect Forms to 200+ Apps
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nasirahmed | Advanced Form Integration — Connect Forms to 200+ Apps | up to 2.6.0 | — | No fix listed | CNA |
- Advanced Form Integration — Connect Forms to 200+ Apps Vendornasirahmed Affected up to 2.6.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16587
- 2026-10-03 Alias added: GHSA-r4fx-q4j5-7gqg
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/af913bb1-eff6-47cd-9471-f74bafda1e52?source=cve
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L98
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L51
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L375
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.6.0/platforms/mailup/mailup.php#L411
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3621411%40advanced-form-integration&new=3621411%40advanced-form-integration
More nasirahmed vulnerabilities
- TI-2024-12171 AFI < 1.100.0 - Admin+ Stored XSS CVSS 3.1LOW 3.5
- TI-2024-12170 AFI < 1.100.0 - Admin+ Stored XSS CVSS 3.1LOW 3.5
- TI-2026-70263 Unverified password change in Advanced Form Integration plugin CVSS 3.1HIGH 8.1
- TI-2026-86454 PHP Object Injection in Advanced Form Integration WordPress plugin CVSS 3.1HIGH 8.1
- TI-2024-21209 WordPress Forms to Zapier plugin <= 1.1.12 - Auth. SQL Injection vulnerability CVSS 3.1HIGH 7.6
- TI-2023-27758 SQL injection in nasirahmed Advanced Form Integration – Connect WooCommerce and Contact… CVSS 3.1HIGH 7.6
Sources
- CVE-2026-16587 · CVE Program
- CVE-2026-16587 · NVD
- FIRST EPSS
- GHSA-r4fx-q4j5-7gqg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences