Skip to content
OpenAdvisories
Medium · 4.3 Public exploit CVE-2026-12400 EUVD-2026-42847GHSA-qcj5-mp4w-93gp

FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

Published Jul 10, 2026 · Updated Jul 14, 2026 · Assigned by Wordfence

Vendor: priyanshuchaudhary Product: FlowForms – Conversational Form Builder Category: Web / CMS

Description

The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1 via the update_form due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the content, design, and settings of, as well as publish or revert, any form on the site — including forms owned by administrators — by supplying an arbitrary form ID in the REST URL.

Affected products

VendorProductAffectedFixed
priyanshuchaudhary FlowForms – Conversational Form Builder ≤ 1.1.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References