Authorization Bypass in Flamingo Plugin for WordPress

CVE-2026-12853

What is CVE-2026-12853?

The Flamingo plugin for WordPress contains a significant flaw that allows authenticated users with contributor-level access and above to bypass authorization controls. This vulnerability permits attackers to enumerate taxonomy terms related to internal forms, department names, workflow identifiers, and submission counts. The plugin fails to adequately validate a user's permissions when accessing certain functionalities, especially through key WordPress core APIs like XML-RPC and admin-ajax. This oversight could lead to potential exposure of sensitive data, undermining the security of the application and its operations.

References