Authorization Bypass in Vedrixa Forms Plugin for WordPress
CVE-2026-8692
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 May 2026
What is CVE-2026-8692?
The Vedrixa Forms plugin for WordPress has a significant authorization bypass vulnerability affecting all versions up to 1.1.1. This occurs because the plugin fails to adequately verify user permissions, allowing authenticated users with a minimum of subscriber access to modify form structures. Attackers can inject controlled data into the plugin's FORMS database table, enabling them to add, remove, or alter fields in any form. The vulnerability arises from the 'ajax-nonce' nonce being publicly accessible via wp_localize_script(), which can be exploited by any authenticated user visiting a form page, posing a risk to site administrators and other users.
Affected Version(s)
Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder 0 <= 1.1.1