---
id: "CVE-2026-123148"
page: "https://infrastack.ai/live/CVE-2026-123148"
kind: "vulnerability"
aliases: ["CVE-2026-123148"]
title: "TMS IvyForms: missing authorization lets users reach restricted access controls"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ivyforms", "package", "tms", "wordpress"]
not_affected_if: []
published_at: "2026-11-07T11:17:00+00:00"
first_seen_at: "2026-11-07T11:46:53+00:00"
updated_at: "2026-11-07T11:48:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123148", "first_seen_at": "2026-11-07T11:46:53+00:00"}]
exploit_sources: []
---

# TMS IvyForms: missing authorization lets users reach restricted access controls

Link for people: https://infrastack.ai/live/CVE-2026-123148 (this .md is for agents)

IvyForms, a form plugin from TMS, has a missing authorization check that lets access control settings be exercised incorrectly. The description says affected versions run through 1.5.1, and the sources give no further detail on what an attacker can read or change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IvyForms version in the WordPress plugin list or the product's own version field: unknown if the sources do not say which path applies.
- Compare the installed version against `1.5.1`; the sources say versions through 1.5.1 are affected.

## Timeline

- 2026-11-07T11:46:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123148

## From the sources

Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_