CVE-2026-11995 describes an authorization bypass vulnerability (CWE-862) in the Gutena Forms plugin for WordPress, affecting all versions up to and including 1.9.0. The vulnerability exists because the plugin fails to properly verify that a user is authorized to perform certain actions on form submission entries. Specifically, unauthenticated attackers can modify the read/unread status or permanently trash arbitrary submissions. The nonce mechanism intended to prevent unauthorized actions is ineffective because the nonce action 'gutena_Forms' is exposed to unauthenticated visitors via wp_localize_script() on any public page containing a Gutena Forms block, allowing attackers to obtain it freely and bypass authorization checks.

An unauthenticated attacker can alter the status or delete form submission entries belonging to any form created with the vulnerable plugin. This compromises the integrity of form data but does not affect confidentiality or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to pages containing Gutena Forms blocks if possible and monitor for suspicious activity related to form submissions. Avoid exposing the nonce publicly or consider disabling the plugin if form submission integrity is critical.