WordPress security changelog
MEDIUM CVE-2026-16587 Deferred

Advanced Form Integration subscribers can overwrite MailUp OAuth tokens

Advanced Form Integration through 2.6.0 attaches auth_redirect() to admin_init, which runs when any logged-in user visits a wp-admin page such as /wp-admin/profile.php. A Subscriber can submit action=adfoin_mailup_auth_redirect with an attacker-controlled OAuth code; the function exchanges that code and save_data() writes the resulting access and refresh tokens into the adfoin_mailup_keys option without checking manage_options. This can redirect future form data to an attacker-controlled MailUp account or replace the tokens with unusable values and break the integration.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Advanced Form Integration — Connect Forms to 200+ Apps
Plugin slug
advanced-form-integration
Affected
<= 2.6.0
Safe version
> 2.6.0
Published
Jul 28, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Jul 28, 2026 and is one of 10 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Advanced Form Integration to a release newer than 2.6.0. The CNA record identifies the affected boundary but does not name a fixed tag; current upstream code requires manage_options before processing the redirect. Reconnect the MailUp integration from a trusted Administrator session and review form-delivery history for unexpected destinations or failures.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources