CVE-2026-74003: WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress RomethemeForm For Elementor pluginto a version that resolves this vulnerability.Fixed in 1.2.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Sites using RomethemeForm For Elementor version 1.2.6 or earlier are in scope. Exploitation requires an authenticated account with Contributor-level privileges.
What can be done if patching is not immediately possible?
The available data does not state whether the vulnerable functionality is enabled in the plugin's default configuration. Review use of the plugin and restrict Contributor accounts to trusted users until an update is available.
How can I assess whether the vulnerability may have been exploited?
The issue can affect integrity, while no confidentiality or availability impact is indicated by the provided severity vector. Review actions performed by Contributor accounts and investigate unexpected content or configuration changes.