CVE-2026-11794 is an improper privilege management vulnerability (CWE-269) in the Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin versions prior to 2.1.1. The flaw arises when the plugin creates WordPress users from public form submissions without restricting the assigned user role. If an active integration maps the user role to a public form field, unauthenticated attackers can exploit this to create administrator accounts. This requires a specific, non-default plugin configuration. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation allows unauthenticated attackers to create administrator accounts on the affected WordPress site, leading to full control over the site. This compromises confidentiality, integrity, and availability of the site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, review and disable any configurations that map user roles to public form fields to prevent unauthorized role assignment.