Summary
CVE-2026-11794 is a high-severity unauthenticated privilege escalation vulnerability in the Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin, affecting all versions prior to 2.1.1. The flaw allows unauthenticated remote attackers to create WordPress administrator accounts by submitting manipulated role values through public-facing forms, resulting in complete site takeover. It carries a CVSS v3.1 score of 8.1 (HIGH).
Technical details
- Root cause: The plugin fails to enforce server-side restrictions on the WordPress role field when creating user accounts from form submissions (CWE-269: Improper Privilege Management). The vulnerability is present in the WooCommerce Create Customer and FluentAffiliate Create Affiliate integration actions, where the role value is accepted directly from attacker-controlled form input without validation.
- Trigger conditions: Exploitation requires an active integration in which the site administrator has mapped the WordPress user role field to a public, attacker-controllable form input — a non-default configuration. Additional prerequisites include having WooCommerce or FluentAffiliate active alongside a Breakdance page builder form configured with such an integration.
- Attack vector: An unauthenticated attacker submits a crafted HTTP POST request to
wp-admin/admin-ajax.phpusing thebreakdance_form_customaction, supplyingadministratoras the role field value. Because no server-side check validates or restricts the submitted role, the plugin creates a fully privileged WordPress administrator account on behalf of the attacker. - Impact: Successful exploitation grants the attacker complete WordPress administrative access, enabling arbitrary plugin or theme installation, backdoor injection, remote code execution, and full site takeover.
Affected software
- Advanced Form Integration — Connect Forms to 200+ Apps: all versions prior to 2.1.1
Severity
- CVSS v3.1 Base Score: 8.1 (HIGH)
- Vector string:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the plugin to version 2.1.1 or later. Version 2.1.1 introduces server-side role validation that explicitly blocks the assignment of privileged roles — including
administrator,editor,author, andshop_manager— via form submissions, and adds security logging for any blocked role assignment attempts. - If immediate update is not possible: Disable or remove any active integrations that map the WordPress user role field to a public-facing form input until the plugin can be updated to version 2.1.1 or later.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

