Advanced Form Integration <= 2.11.3 - Unauthenticated Privilege Escalation via FluentAffiliate Create Affiliate Action
- ID
- WPSEC-2026-2933
- Plugin
- Advanced Form Integration — Connect Forms to 300+ Apps (advanced-form-integration)
- Affected
- from 1.123.0 before 2.11.5
- Remediation
- Update to 2.11.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Advanced Form Integration on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via the FluentAffiliate Create Affiliate action in all versions up to, and including, 2.11.3, due to the role check relying on an incomplete name-based blocklist (administrator, editor, author, shop_manager) instead of the role's capabilities. This makes it possible for unauthenticated attackers to create a WordPress account with the contributor role or any privileged custom role registered on the site, including custom roles that carry administrative capabilities. Exploitation requires a public form connected to this action with the role mapped from a submitted form field.
References
- https://wpsec.com/vuln/WPSEC-2026-2933/
- https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.11.5/
- https://wordpress.org/plugins/advanced-form-integration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS