{"id":"CVE-2026-125769","kind":"vulnerability","aliases":["CVE-2026-125769"],"related":[],"title":"WordPress Advanced Form Integration plugin: privilege escalation through incorrect privilege assignment","description":"Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a through 2.11.3.","summary":"The Advanced Form Integration WordPress plugin assigns privileges incorrectly, which lets a user gain rights they should not have. An attacker who exploits it can escalate privileges on the affected WordPress site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"advanced-form-integration","fixed":["2.11.5"],"affected":"<= 2.11.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["advanced-form-integration","other","privilege-escalation","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, or with wp plugin list, check the version of advanced-form-integration. 2.11.3 or lower is affected; 2.11.5 or later is fixed.\n- WPSec's two matching advisories describe a role check in the WooCommerce Create Customer and FluentAffiliate Create Affiliate actions. Check whether any integration on the site uses those actions. Neither advisory cites this CVE id, so the match is not confirmed.","fix":"Update Advanced Form Integration to 2.11.5 or later (per WPSec, fix released 2026-11-10; not confirmed on the vendor's own page).","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:20+00:00","updated_at":"2026-11-15T14:38:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T14:37:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WordPress Advanced Form Integration plugin: privilege escalation through incorrect privilege assignment","impact":"high","summary":"The Advanced Form Integration WordPress plugin assigns privileges incorrectly, which lets a user gain rights they should not have. An attacker who exploits it can escalate privileges on the affected WordPress site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wordpress-plugin","advanced-form-integration"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the WordPress site","analyst_note":"Find the first fixed version and the required role for CVE-2026-125769 on the WordPress.org plugin page or NVD, since the sources only say 'through 2.11.3'.","how_to_check":"- Check the installed version of the Advanced Form Integration plugin (`advanced-form-integration`) on each WordPress site. Versions through `2.11.3` are affected.\n- Check whether the plugin is active on the site at all.","plain_action":"","product_name":"advanced-form-integration","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Advanced Form Integration plugin at version 2.11.3 or earlier are exposed. The sources do not say which roles or settings are needed to trigger it, so sites with the plugin installed should treat themselves as potentially affected. Sites without the plugin installed can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00131,"input_tokens":4545,"output_tokens":1711,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the first fixed version and the required role for CVE-2026-125769 on the WordPress.org plugin page or NVD, since the sources only say 'through 2.11.3'.","search":"'-125769':14A,17A '-2026':13A,16A '2.11.3':91C 'advanc':2A,23B,35B,73C,77C,85C 'advanced':19A 'advanced-form-integr':22B,76C 'advanced-form-integration':18A 'affect':63B,84C 'ahm':72C 'allow':80C 'assign':11A,40B,68C 'attack':54B 'cve':12A,15A 'escal':7A,29B,59B 'escalation.this':82C 'exploit':56B 'form':3A,20A,24B,36B,74C,78C,86C 'gain':47B 'incorrect':9A,42B,66C 'integr':4A,25B,37B,75C,79C,87C 'integration':21A 'issu':83C 'let':44B 'n/a':89C 'nasir':71C 'plugin':5A,33B,39B 'privileg':6A,10A,28B,41B,60B,67C,81C 'privilege-escal':27B 'right':48B 'site':65B 'user':46B 'vulner':69C 'wordpress':1A,30B,32B,38B,64B 'wordpress-plugin':31B","nicknames":[],"mitigations":[],"who_affected":"Sites running Advanced Form Integration 2.11.3 or earlier. WPSec's two related advisories (WPSEC-2026-2933 and -2934) describe unauthenticated attackers creating accounts with the contributor role or a privileged custom role. They say this works through the WooCommerce Create Customer or FluentAffiliate Create Affiliate integration actions, so sites using those actions are the likeliest to be reachable. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["advancedformintegration"],"ptokens":["advanced","form","integration"],"labels":["advancedformintegration","critical","other","privilegeescalation","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-125769':14A,17A '-2026':13A,16A 'advanc':2A 'advanced':19A 'advanced-form-integration':18A 'assign':11A 'cve':12A,15A 'escal':7A 'form':3A,20A 'incorrect':9A 'integr':4A 'integration':21A 'plugin':5A 'privileg':6A,10A 'wordpress':1A","search_b":"'advanc':23B,35B 'advanced-form-integr':22B 'affect':63B 'assign':40B 'attack':54B 'escal':29B,59B 'exploit':56B 'form':24B,36B 'gain':47B 'incorrect':42B 'integr':25B,37B 'let':44B 'plugin':33B,39B 'privileg':28B,41B,60B 'privilege-escal':27B 'right':48B 'site':65B 'user':46B 'wordpress':30B,32B,38B,64B 'wordpress-plugin':31B","search_c":"'2.11.3':91C 'advanc':73C,77C,85C 'advanced-form-integr':76C 'affect':84C 'ahm':72C 'allow':80C 'assign':68C 'escalation.this':82C 'form':74C,78C,86C 'incorrect':66C 'integr':75C,79C,87C 'issu':83C 'n/a':89C 'nasir':71C 'privileg':67C,81C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125769","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125769","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125769:4042","url":"https://wpsec.com/vuln/WPSEC-2026-2934/","severity":null,"published_at":"2026-11-15T14:38:17+00:00","modified_at":"2026-11-15T14:38:17+00:00","first_seen_at":"2026-11-15T14:38:17+00:00","fetched_at":"2026-11-15T14:38:17+00:00","note":"NVD gives only '<= 2.11.3'. WPSec advisories 2933 and 2934 (<=2.11.3, fixed 2.11.5, CVSS 8.1 AC:H) fit Patchstack's '2 days ago' Privilege Escalation <= 2.11.3 entry. Neither cites CVE-2026-125769, so the mapping is inferred. NVD scores it 9.8, WPSec 8.1; severity left unchanged. No vendor changelog was reachable, so nothing is marked verified. No exploitation or PoC found; X not checked.","cites":["https://wpsec.com/vuln/WPSEC-2026-2934/","https://wpsec.com/vuln/WPSEC-2026-2933/"]}],"documents":[{"id":163836,"url":"https://wpsec.com/vuln/WPSEC-2026-2934/","title":"WPSEC-2026-2934 AFI <= 2.11.3 WooCommerce Create Customer privilege escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":163837,"url":"https://wpsec.com/vuln/WPSEC-2026-2933/","title":"WPSEC-2026-2933 AFI <= 2.11.3 FluentAffiliate Create Affiliate privilege escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}