CVE-2026-104797 nasirahmed CVE debrief

Who should care

WordPress administrators and users of the Advanced Form Integration plugin should assess their exposure and take immediate action to update the plugin and restrict access to the Contact Form 7 plugin. Security teams should monitor for suspicious activity and consider implementing additional security measures.

Why it matters

CVE-2026-104797 is a high-severity vulnerability in the Advanced Form Integration plugin for WordPress, allowing unauthenticated attackers to change user passwords and potentially take over the site. Defenders should immediately update the plugin, restrict Contact Form 7 access, and monitor for suspicious activity.

• Unauthenticated attackers can change the password of any WordPress user account, including Administrator accounts.
• This vulnerability can lead to full site takeover if exploited.
• Defenders should verify the plugin version and restrict public submissions to the Contact Form 7 plugin.
• Remediation priority is high due to the potential for site takeover.

Technical summary

The Advanced Form Integration plugin for WordPress has a vulnerability that allows unauthenticated attackers to change the password of any WordPress user account. This is achieved through the adfoin_ultimatememberac_send_data function, which is used in the Ultimate Member 'Update Profile Field' action. The function does not perform necessary checks, allowing attackers to submit a public Contact Form 7 form with a target email and user_pass as the field key, effectively bypassing authentication.

Defensive priority

High

Recommended defensive actions

• Immediately update the Advanced Form Integration plugin to a version beyond 2.9.0.
• Restrict access to the Contact Form 7 plugin to prevent public submissions.
• Monitor user account changes and investigate any suspicious password change attempts.
• Consider implementing additional security measures such as two-factor authentication.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the adfoin_ultimatememberac_send_data function, which powers the Ultimate Member 'Update Profile Field' action. This function resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to UM()->user()->update_profile() without performing any submitter identity verification, ownership check, capability check, current-password reauthentication, or restriction on sensitive keys such as user_pass.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.