What’s Vulnerable › Vulnerabilities
CVE-2026-1753: Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-11 · updated 2026-06-17
- Weakness: CWE-639
Description
The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
Affected products
- Gutena Forms: before 1.6.1 — fixed in 1.6.1
How to fix
Upgrade to a fixed version: Gutena Forms 1.6.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-1753 or the next vulnerability affects your stack