{"id":"CVE-2026-1753","state":"PUBLISHED","title":"Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update","description":"The Gutena Forms  WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).","publishedAt":"2026-03-11T06:00:03.165Z","updatedAt":"2026-03-11T13:46:58.114Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Gutena Forms"],"affected":[{"vendor":"Unknown","product":"Gutena Forms","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.6.1","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d/"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1753.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1753","state":"PUBLISHED","datePublished":"2026-03-11T06:00:03.165Z","dateUpdated":"2026-03-11T13:46:58.114Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-02-02T09:47:03.130Z"},"containers":{"cna":{"title":"Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update","descriptions":[{"lang":"en","value":"The Gutena Forms  WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register)."}],"affected":[{"vendor":"Unknown","product":"Gutena Forms","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.6.1","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-03-11T06:00:03.165Z"},"credits":[{"lang":"en","value":"yiğit ibrahim sağlam","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-03-11T13:44:58.202429Z","id":"CVE-2026-1753","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","type":"CWE","lang":"en","description":"CWE-639 Authorization Bypass Through User-Controlled Key"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-11T13:46:58.114Z"}}]}}}