CVE-2026-11794 is a privilege management vulnerability (CWE-269) in the Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin versions prior to 2.1.1. The plugin fails to restrict the WordPress role assigned during user creation from public form submissions. When an active integration maps the user role to a public form field in a specific non-default configuration, unauthenticated attackers can create accounts with administrator privileges. This vulnerability requires this particular configuration to be exploitable. No official patch or remediation guidance has been published as of the data provided.

Successful exploitation allows unauthenticated attackers to create administrator accounts on the affected WordPress site, leading to full control over the site. This includes the ability to modify content, install plugins, change configurations, and potentially compromise the entire hosting environment. The vulnerability has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review their plugin configurations to ensure that user role assignment is not mapped to public form fields. Restrict or disable public form submissions that can create user accounts, especially with elevated privileges. Monitor plugin updates from the vendor and apply official patches promptly once released.