CVE-2026-104797 | CVSS: 8.1 | 严重级别: HIGH
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to `UM()->user()->update_profile()` in the `account` context — which explicitly bypasses Ultimate Member's banned-key validation — without performing any
参考链接:
• https://plugins.trac.wordpress.org/browser/advanced-form-integration/
• https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/
• https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/2.9.0/
📌 数据来源: NVD 官方