CVE-2026-11995

Name of the Vulnerable Software and Affected Versions Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions prior to 1.9.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can modify the read/unread status of or permanently trash arbitrary form submission entries for any form. This occurs because the nonce (a unique token used to prevent cross-site request forgery) issued by the check ajax referer() function is emitted to unauthenticated visitors via wp localize script() on any public page containing a Gutena Forms block, allowing anonymous attackers to obtain it easily.

Recommendations Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to version 1.9.1 or later.