---
id: "CVE-2026-125769"
page: "https://infrastack.ai/live/CVE-2026-125769"
kind: "vulnerability"
aliases: ["CVE-2026-125769"]
title: "WordPress Advanced Form Integration plugin: privilege escalation through incorrect privilege assignment"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "advanced-form-integration", "fixed": ["2.11.5"], "affected": "<= 2.11.3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["advanced-form-integration", "other", "privilege-escalation", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T14:17:24+00:00"
first_seen_at: "2026-11-15T14:36:14+00:00"
updated_at: "2026-11-15T14:38:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125769", "first_seen_at": "2026-11-15T14:36:14+00:00"}, {"source": "analyst", "url": "https://wpsec.com/vuln/WPSEC-2026-2934/", "first_seen_at": "2026-11-15T14:38:17+00:00", "cites": ["https://wpsec.com/vuln/WPSEC-2026-2934/", "https://wpsec.com/vuln/WPSEC-2026-2933/"]}]
exploit_sources: []
---

# WordPress Advanced Form Integration plugin: privilege escalation through incorrect privilege assignment

Link for people: https://infrastack.ai/live/CVE-2026-125769 (this .md is for agents)

The Advanced Form Integration WordPress plugin assigns privileges incorrectly, which lets a user gain rights they should not have. An attacker who exploits it can escalate privileges on the affected WordPress site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:advanced-form-integration affected <= 2.11.3 fixed 2.11.5

## How to check

- In WordPress admin > Plugins, or with wp plugin list, check the version of advanced-form-integration. 2.11.3 or lower is affected; 2.11.5 or later is fixed.
- WPSec's two matching advisories describe a role check in the WooCommerce Create Customer and FluentAffiliate Create Affiliate actions. Check whether any integration on the site uses those actions. Neither advisory cites this CVE id, so the match is not confirmed.

## Fix

Update Advanced Form Integration to 2.11.5 or later (per WPSec, fix released 2026-11-10; not confirmed on the vendor's own page).

## Timeline

- 2026-11-15T14:36:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125769
- 2026-11-15T14:38:17+00:00 analyst https://wpsec.com/vuln/WPSEC-2026-2934/ — NVD gives only '<= 2.11.3'. WPSec advisories 2933 and 2934 (<=2.11.3, fixed 2.11.5, CVSS 8.1 AC:H) fit Patchstack's '2 days ago' Privilege Escalation <= 2.11.3 entry. Neither cites CVE-2026-125769, so the mapping is inferred. NVD scores it 9.8, WPSec 8.1; severity left unchanged. No vendor changelog was reachable, so nothing is marked verified. No exploitation or PoC found; X not checked.

## Documents

- [describes] WPSEC-2026-2934 AFI <= 2.11.3 WooCommerce Create Customer privilege escalation https://wpsec.com/vuln/WPSEC-2026-2934/
- [describes] WPSEC-2026-2933 AFI <= 2.11.3 FluentAffiliate Create Affiliate privilege escalation https://wpsec.com/vuln/WPSEC-2026-2933/

## From the sources

Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a through 2.11.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_