Authorization Bypass Vulnerability in Gutena Forms Plugin for WordPress
CVE-2026-11995
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 August 2026
What is CVE-2026-11995?
The Gutena Forms plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 1.9.0. This flaw arises from inadequate user authorization checks, allowing unauthenticated attackers to alter the read/unread status of or permanently delete any form submission entries. The vulnerability is exacerbated as the nonce used by check_ajax_referer() does not provide an effective authorization barrier. Any public page with a Gutena Forms block transmits the nonce action 'gutena_Forms' to unauthenticated visitors, making it easily accessible for malicious actors. Users are urged to update to a patched version to mitigate risks.
Affected Version(s)
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder 0 <= 1.9.0