Advanced Form Integration <= 2.11.3 - Unauthenticated Privilege Escalation via WooCommerce Create Customer Action
- ID
- WPSEC-2026-2934
- Plugin
- Advanced Form Integration — Connect Forms to 300+ Apps (advanced-form-integration)
- Affected
- from 1.123.0 before 2.11.5
- Remediation
- Update to 2.11.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Advanced Form Integration on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Form Integration plugin for WordPress is vulnerable to Privilege Escalation via the WooCommerce Create Customer action in all versions up to, and including, 2.11.3, due to the role check relying on an incomplete name-based blocklist (administrator, editor, author, shop_manager) instead of the role's capabilities. This makes it possible for unauthenticated attackers to register a customer account with the contributor role or any privileged custom role registered on the site, including custom roles that carry administrative capabilities. Exploitation requires a public form connected to this action with the User Role field mapped from a submitted form field.
References
- https://wpsec.com/vuln/WPSEC-2026-2934/
- https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.11.5/
- https://wordpress.org/plugins/advanced-form-integration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS