Read the docs
TI-2026-86527 Aliases CVE-2026-123148GHSA-6qhg-q8g2-g99g

WordPress IvyForms plugin broken access control from missing authorization

Priority LOW 27CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

TMS IvyForms, a WordPress plugin, has a missing authorization flaw (CWE-862) that allows exploiting incorrectly configured access control security levels. The issue affects IvyForms from n/a through 1.5.1. The CVSS 3.1 base score is 5.3 (MEDIUM), with low integrity impact and no confidentiality or availability impact. CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TMSIvyFormsup to 1.5.1—No fix listedCNA
  • IvyForms VendorTMS Affected up to 1.5.1 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for IvyForms. Monitor TMS for an update and apply it once one is released.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-123148
  2. 2026-11-07 Alias added: GHSA-6qhg-q8g2-g99g
  3. 2026-11-07 CISA SSVC decision points changed

References

Other 1

  • TI-2023-03986 wpDataTables < 2.1.66 - Admin+ PHP Object Injection CVSS 3.1HIGH 7.2
  • TI-2024-14885 WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-79219 SQL injection in TMS Amelia WordPress plugin CVSS 3.1CRITICAL 9.3
  • TI-2026-36306 WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2026-74726 SQL injection in TMS Amelia WordPress plugin CVSS 3.1CRITICAL 9.3
  • TI-2022-00601 Amelia < 1.0.46 - Manager+ RCE CVSS 3.1HIGH 8.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences