CVE-2026-104797

8.1 HIGH

Published 2026-10-10 · Updated 2026-10-13

AI risk analysis

Summary: The plugin allows unauthenticated attackers to bypass authentication and change any WordPress user's password by exploiting a vulnerable function that updates Ultimate Member profile fields without verifying the submitter's identity or checking user permissions. This enables full site takeover through a simple form submission.
Exploitability: Exploitation requires an administrator to have pre-configured a Contact Form 7 integration mapping public form inputs to the Ultimate Member Update Profile Field action, but once configured it's relatively easy to exploit with a single form submission containing target email and user_pass field.
Blast radius: The vulnerability could lead to complete site compromise as attackers can change administrator passwords and gain full control over the WordPress installation.
Detection: Monitor for unusual calls to UM()->user()->update_profile() function in WordPress logs, particularly when triggered by public Contact Form 7 submissions with user_pass field updates, and watch for unexpected password change events in user activity logs.
Prioritized remediation: Upgrade to version 2.9.1 or later to fix the authentication bypass vulnerability.

auth-bypasswordpresspluginformauthentication

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to `UM()->user()->update_profile()` in the `account` context — which explicitly bypasses Ultimate Member's banned-key validation — without performing any submitter identity verification, ownership check, capability check, current-password reauthentication, or restriction on sensitive keys such as `user_pass`. This makes it possible for unauthenticated attackers to change the password of any WordPress user account, including Administrator accounts, by submitting a public Contact Form 7 form with a target email and `user_pass` as the field key, enabling full site takeover. Exploitation requires an administrator to have pre-configured a Contact Form 7 integration that maps the target email, field key, and value from public form inputs to the Ultimate Member Update Profile Field action — the exact workflow the plugin's own UI advertises for this action type.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.