Now officially on WordPress.org

CVE Database / CVE-2026-48835

CVE · High

CVE-2026-48835 — WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.5

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-48835 WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More [wpforms-lite] < 1.10.0.5 Missing Authorization High 7.5 < 1.10.0.5 1.10.0.5 2026-05-28 —

CVE-2026-48835

The WPForms plugin for WordPress contains a flaw that allows unauthorized individuals to bypass security checks, enabling them to execute certain actions without proper authentication, affecting versions prior to 1.10.0.5. This vulnerability stems from the absence of capability verification on a specific function within these versions. As a result, attackers can exploit this weakness to perform unauthorized operations.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings