Vulnerability · Published Mar 11, 2026 · Assigned by WPScan

CVE-2026-1753Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update

Medium 6.8

In plain English

A medium-severity authorization bypass via user-controlled key in Gutena Forms from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 86.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).

Affected products (as reported)

Vendor	Product	Versions
Unknown	Gutena Forms	0 – before 1.6.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

References

https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d/ exploit, vdb-entry, technical-description