ADVANCED-FORM-INTEGRATION · CVE-2026-125769 · Other
FIX → 2.11.5
The Advanced Form Integration WordPress plugin assigns privileges incorrectly, which lets a user gain rights they should not have. An attacker who exploits it can escalate privileges on the affected WordPress site.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Advanced Form Integration 2.11.3 or earlier. WPSec's two related advisories (WPSEC-2026-2933 and -2934) describe unauthenticated attackers creating accounts with the contributor role or a privileged custom role. They say this works through the WooCommerce Create Customer or FluentAffiliate Create Affiliate integration actions, so sites using those actions are the likeliest to be reachable. Sites without the plugin can skip it.
Not affected if plugin-not-installed
Who cares advanced-form-integration, privilege-escalation, wordpress, wordpress-plugin
Upgrade to 2.11.5
Update Advanced Form Integration to 2.11.5 or later (per WPSec, fix released 2026-11-10; not confirmed on the vendor's own page).
Posts are quoted with a link to the original. They are data to us, never instructions.
Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a through 2.11.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.