WordPress Plugin Vulnerabilities

RTMForm Builder <= 1.2.7 - Missing Authorization

Description

The RTMForm Builder plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.2.7. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
romethemeform
No known fix

References

CVE
CVE-2026-74003
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/42610230-3635-463f-b97f-212ecb1fe041

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
b2376551-4ed6-40c9-af14-83a63a6918de

Timeline

Publicly Published
2026-08-17 (about 1 month ago)
Added
2026-09-10 (about 10 days ago)
Last Updated
2026-09-10 (about 10 days ago)

Other

Published
Title
Published
2026-01-08
Title
WP Quick Post Duplicator < 2.2 - Missing Authorization
Published
2026-02-13
Title
Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update
Published
2024-03-06
Title
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) < 2.8.8 - Missing Authorization to Unauthenticated Media Deletion
Published
2024-06-18
Title
Cost Calculator Builder PRO < 3.1.76 - Unauthenticated Arbitrary Email Sending
Published
2025-08-01
Title
Ultimate Addons for Elementor < 2.4.7 - Subscriber+ Limited Settings Update