CVE-2026-11794 Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping
Unauthenticated attackers can create administrator accounts via public form submissions if role mapping is configured, requiring plugin upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11794?
CVE-2026-11794 is a high-severity vulnerability in Unknown Advanced Form Integration — Connect Forms to 200+ Apps, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.
Which versions are affected by CVE-2026-11794?
How do I fix CVE-2026-11794?
No fix has been published for CVE-2026-11794 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11794 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11794 exists.
Sources
Also known as GHSA-cp9r-mj2w-vwpx.