CVE-2026-12853 describes an authorization bypass vulnerability in the Flamingo plugin for WordPress, affecting all versions up to and including 2.6.2. The vulnerability arises because the plugin fails to properly verify user authorization for certain actions, specifically allowing authenticated users with contributor-level privileges or above to enumerate sensitive taxonomy terms. These terms include channel names derived from Contact Form 7 form titles, which may reveal internal organizational information such as form purposes, department names, workflow identifiers, submission counts per channel, and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to the Flamingo admin UI but does not extend protection to WordPress core APIs such as XML-RPC's wp.getTerms method and the admin-ajax ajax-tag-search endpoint, enabling this unauthorized information disclosure.

The vulnerability allows authenticated users with contributor-level access or higher to bypass authorization controls and enumerate sensitive taxonomy terms. This can lead to information disclosure of internal form purposes, department names, workflow identifiers, submission counts, and contact tags. While it does not allow full administrative control or data modification, the exposure of internal organizational information could aid attackers in further reconnaissance or targeted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access where possible and monitor for suspicious activity related to taxonomy term enumeration via XML-RPC and admin-ajax endpoints. Avoid exposing sensitive taxonomy information through these APIs.