| CVE ID | CVE-2026-104797 |
| Severity | HIGH — CVSS CVSS V3.1 8.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-287 CWE-287 Improper Authentication |
| Produk | nasirahmed / Advanced Form Integration — Connect Forms to 300+ Apps — 0 (affected) |
| Dipublikasikan | 2026-10-10 |
Ringkasan Cepat
- CVE-2026-104797 adalah kerentanan improper authentication (CWE-287) pada plugin WordPress Advanced Form Integration hingga versi 2.9.0.
- Fungsi Ultimate Member Update Profile Field dapat mengubah profil tanpa verifikasi identitas, pemeriksaan kepemilikan, kapabilitas, atau reautentikasi password.
- Dampaknya autentikasi bypass dan eskalasi hak akses; eksploitasi memerlukan integrasi Contact Form 7 yang telah dikonfigurasi administrator.
Ringkasan Kerentanan
CVE-2026-104797 adalah kerentanan keamanan yang dipublikasikan pada 10 Oktober 2026 dan diberi judul CNA Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action. Deskripsi resmi menyebutkan plugin WordPress Advanced Form Integration — Connect Forms to 300+ Apps rentan terhadap Authentication Bypass melalui Unverified Password Change pada semua versi hingga dan termasuk 2.9.0.
Fungsi adfoin_ultimatememberac_send_data, yang menjalankan action Ultimate Member Update Profile Field, menyelesaikan target pengguna WordPress dari alamat email yang dipasok penyerang dan meneruskan field key serta value yang dikendalikan penyerang langsung ke UM()->user()->update_profile() dalam konteks account. Konteks ini secara eksplisit melewati validasi banned-key milik Ultimate Member, tanpa verifikasi identitas pengirim, pemeriksaan kepemilikan, pemeriksaan kapabilitas, reautentikasi password saat ini, atau pembatasan pada kunci sensitif seperti user_pass.
Severity resmi adalah HIGH 8.1 dengan vektor CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE yang terkait adalah CWE-287 Improper Authentication.
Dampak Teknis dan Tingkat Keparahan
Dampak utama kerentanan ini adalah autentikasi bypass dan privilege escalation. Menurut deskripsi resmi, penyerang yang tidak terautentikasi dapat mengubah password akun WordPress mana pun, termasuk akun Administrator, dengan memanfaatkan form Contact Form 7 publik. Dalam skenario terburuk, hal ini memungkinkan full site takeover.
Vektor CVSS menunjukkan dampak tinggi pada kerahasiaan, integritas, dan ketersediaan. Meskipun kompleksitas serangan dinilai tinggi karena memerlukan konfigurasi awal, prasyarat tersebut adalah alur kerja yang memang dipromosikan oleh UI plugin untuk action Ultimate Member Update Profile Field. Artinya, situs yang mengikuti panduan integrasi plugin berpotensi berada dalam kondisi berisiko.
Kerentanan ini tidak memerlukan autentikasi awal dari sisi penyerang, tetapi memerlukan administrator telah mengonfigurasi integrasi Contact Form 7 yang memetakan email target, field key, dan value dari input form publik ke action Ultimate Member Update Profile Field.
Produk Terdampak dan Konfigurasi Pemicu
Produk terdampak adalah plugin Advanced Form Integration — Connect Forms to 300+ Apps dari vendor nasirahmed. Judul CNA dan deskripsi resmi menyatakan semua versi hingga dan termasuk 2.9.0 terpengaruh. Data produk pada referensi CVE mencatat status affected untuk plugin tersebut.
Pemicu kerentanan adalah integrasi Contact Form 7 yang dikonfigurasi administrator dan diarahkan ke action Ultimate Member Update Profile Field. Fungsi terkait menerima email target serta field key dan value dari input form publik, lalu memprosesnya tanpa verifikasi yang memadai. Karena UI plugin sendiri mengiklankan workflow untuk tipe action ini, konfigurasi yang tampak normal dapat membuka permukaan serangan yang serius bila tidak diperbarui atau diaudit.
Konteks Publikasi dan Referensi
Kerentanan ini tercatat dengan ID CVE-2026-104797 dan dipublikasikan pada 2026-10-10T03:26:44.569Z. Referensi resmi mencakup Wordfence Threat Intel serta sejumlah tautan ke repositori plugin di plugins.trac.wordpress.org, termasuk file ultimatememberac.php dan cf7.php. Changeset yang direferensikan juga mencatat tag versi 2.10.0.
Dari perspektif pertahanan, kasus ini menegaskan pentingnya audit integrasi form-to-plugin, pembatasan field yang boleh dipetakan dari input publik, dan pemantauan pembaruan vendor. Situs yang memakai plugin ini sebaiknya memeriksa konfigurasi Ultimate Member Update Profile Field dan memastikan tidak ada pemetaan sensitif yang tidak diperlukan.
Mitigasi dan Perbaikan
- Perbarui plugin Advanced Form Integration ke versi terbaru yang tersedia. Referensi changeset mencatat tag 2.10.0; validasi ketersediaannya di repositori resmi dan lakukan backup sebelum pembaruan.
- Jika pembaruan belum memungkinkan, nonaktifkan sementara plugin atau action Ultimate Member Update Profile Field pada integrasi yang aktif sampai patch diterapkan.
- Audit semua integrasi Contact Form 7 dan mapping ke Ultimate Member Update Profile Field. Hapus mapping yang tidak diperlukan dan jangan memetakan field sensitif seperti user_pass dari form publik.
- Tinjau akun pengguna, khususnya Administrator, untuk aktivitas perubahan profil atau password yang tidak sah. Pertimbangkan reset password berisiko dan aktifkan autentikasi dua faktor.
- Pantau log keamanan, pembaruan vendor, dan sumber Wordfence Threat Intel untuk informasi lanjutan terkait CVE-2026-104797.
Referensi Resmi
- CVE-2026-104797 — CVE Program (cve.org)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/586fd95e-88c7-4eb8-826c-ae46a11ac21f?source=cve
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/platforms/ultimatememberac/ultimatememberac.php#L169
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/platforms/ultimatememberac/ultimatememberac.php#L83
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/includes/triggers/cf7/cf7.php#L38
- https://plugins.trac.wordpress.org/browser/advanced-form-integration/
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3725787%40advanced-form-integration%2Ftags%2F2.10.0&old=3707004%40advanced-form-integration%2Ftags%2F2.9.0
Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.
Pertanyaan yang Sering Diajukan (FAQ)
Apa itu CVE-2026-104797?
Apakah penyerang perlu login terlebih dahulu?
Siapa yang berisiko terdampak?
Apa dampak terburuknya?
Apa langkah pertama yang sebaiknya dilakukan?
Mengapa validasi Ultimate Member bisa dilewati?
English Version — ",
Quick Summary
- ",
- "- CVE-2026-104797 is an improper authentication vulnerability (CWE-287) in the WordPress plugin Advanced Form Integration up to version 2.9.0.",
- "- The Ultimate Member Update Profile Field function can modify profiles without identity verification, ownership checks, capability checks, or password reauthentication.",
- "- The impact is authentication bypass and privilege escalation; exploitation requires a Contact Form 7 integration configured by an administrator.",
- "
Vulnerability Summary
", "CVE-2026-104797 is a security vulnerability published on October 10, 2026, and titled CNA Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action. The official description states that the WordPress plugin Advanced Form Integration — Connect Forms to 300+ Apps is vulnerable to Authentication Bypass through Unverified Password Change in all versions up to and including 2.9.0.
", "The adfoin_ultimatememberac_send_data function, which executes the Ultimate Member Update Profile Field action, resolves the target WordPress user from an attacker-supplied email address and passes attacker-controlled field keys and values directly to UM()->user()->update_profile() in the account context. This context explicitly bypasses Ultimate Member's banned-key validation, without verifying the sender's identity, ownership checks, capability checks, current password reauthentication, or restrictions on sensitive keys such as user_pass.
The official severity is HIGH 8.1 with the CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector. The associated CWE is CWE-287 Improper Authentication.
", "Technical Impact and Severity
", "The primary impact of this vulnerability is authentication bypass and privilege escalation. According to the official description, an unauthenticated attacker can change the password of any WordPress account, including Administrator accounts, by leveraging a public Contact Form 7 form. In the worst-case scenario, this enables full site takeover.
", "The CVSS vector indicates high impact on confidentiality, integrity, and availability. Although attack complexity is rated high because it requires initial configuration, that prerequisite is a workflow actually promoted by the plugin UI for the Ultimate Member Update Profile Field action. This means sites following the plugin's integration guidance may potentially be at risk.
", "This vulnerability does not require initial authentication on the attacker's side, but it does require that an administrator has configured a Contact Form 7 integration that maps the target email, field keys, and values from public form input to the Ultimate Member Update Profile Field action.
", "Affected Products and Triggering Configuration
", "The affected product is the Advanced Form Integration — Connect Forms to 300+ Apps plugin from vendor nasirahmed. The CNA title and official description state that all versions up to and including 2.9.0 are affected. The product data in the CVE reference records an affected status for this plugin.
", "The vulnerability trigger is a Contact Form 7 integration configured by an administrator and directed to the Ultimate Member Update Profile Field action. The related function receives the target email as well as field keys and values from public form input, then processes them without adequate verification. Because the plugin UI itself advertises the workflow for this action type, a seemingly normal configuration can open a serious attack surface if not updated or audited.
", "Publication Context and References
", "This vulnerability is recorded under ID CVE-2026-104797 and was published on 2026-10-10T03:26:44.569Z. Official references include Wordfence Threat Intel as well as several links to the plugin repository at plugins.trac.wordpress.org, including the files ultimatememberac.php and cf7.php. The referenced changeset also records the version 2.10.0 tag.
From a defensive perspective, this case underscores the importance of auditing form-to-plugin integrations, restricting which fields can be mapped from public input, and monitoring vendor updates. Sites using this plugin should review their Ultimate Member Update Profile Field configuration and ensure there are no unnecessary sensitive mappings.
", "Mitigation
- ",
- "- Update the Advanced Form Integration plugin to the latest available version. The changeset reference records the 2.10.0 tag; validate its availability in the official repository and back up before updating.",
- "- If updating is not yet possible, temporarily disable the plugin or the Ultimate Member Update Profile Field action on active integrations until a patch is applied.",
- "- Audit all Contact Form 7 integrations and mappings to Ultimate Member Update Profile Field. Remove unnecessary mappings and do not map sensitive fields such as user_pass from public forms.",
- "- Review user accounts, especially Administrator accounts, for unauthorized profile or password changes. Consider resetting passwords at risk and enable two-factor authentication.",
- "- Monitor security logs, vendor updates, and Wordfence Threat Intel sources for further information related to CVE-2026-104797.",
- "
Komentar
Posting Komentar