CVE-2026-11995 describes an authorization bypass vulnerability (CWE-862) in the Gutena Forms WordPress plugin (Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder). Versions up to and including 1.9.0 do not properly verify that a user is authorized to perform actions on form submissions. The nonce used for AJAX requests (via check_ajax_referer()) is ineffective as an authorization barrier because the nonce action 'gutena_Forms' is exposed to unauthenticated users through wp_localize_script() on any public page with a Gutena Forms block. This allows anonymous attackers to modify or delete form submission entries arbitrarily.

An unauthenticated attacker can modify the read/unread status or permanently trash any form submission entries belonging to any form managed by the plugin. There is no confidentiality or availability impact reported, but the integrity of form submission data can be compromised. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict public access to pages containing Gutena Forms blocks or disable the plugin if possible to prevent exploitation. Monitor vendor channels for updates and apply official patches once released.