Insecure Direct Object Reference Vulnerability in FlowForms Plugin for WordPress

CVE-2026-12400

What is CVE-2026-12400?

The FlowForms – Conversational Form Builder plugin for WordPress is susceptible to an Insecure Direct Object Reference due to inadequate validation of user-controlled keys in the update_form function. This vulnerability allows authenticated attackers with contributor-level privileges or higher to manipulate any forms on the site—altering content, design, settings, and even the publication status of forms, including those created by administrators, simply by using an arbitrary form ID in the REST API URL.

References