CVE-2026-12853: CWE-862 Missing Authorization in rocklobsterinc Flamingo

CVE-2026-12853 is an authorization bypass vulnerability in the Flamingo plugin for WordPress, affecting all versions up to and including 2.6.2. The flaw arises from improper verification of user permissions, allowing authenticated users with contributor-level privileges or above to enumerate taxonomy terms. These terms include channel names derived from Contact Form 7 form titles, potentially exposing internal form purposes, department names, workflow identifiers, submission counts per channel, and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to the Flamingo admin UI but does not extend protection to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search, enabling this unauthorized information disclosure.

The vulnerability allows authenticated users with contributor-level access or higher to bypass authorization controls and enumerate sensitive taxonomy terms. This can lead to information disclosure of internal form purposes, department names, workflow identifiers, submission counts, and contact tag names. There is no indication of direct impact on data integrity or availability. The CVSS score of 5.4 reflects a medium severity impact primarily related to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access where possible and monitor for suspicious activity related to taxonomy enumeration. Since the vulnerability involves WordPress core APIs, consider disabling or restricting XML-RPC and admin-ajax endpoints if feasible to reduce exposure.