PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39594 Themefic CVE debrief

A Subscriber Broken Access Control vulnerability was found in Ultra Addons for WPForms versions <= 1.0.11. This vulnerability has a CVSS score of 6.4 and a severity of MEDIUM. The vulnerability was published on [2026-06-15T21:16:48.167Z](https://www.cve.org/CVERecord?id=CVE-2026-39594) and last modified on [2026-06-15T21:24:32.790Z](https://www.cve.org/CVERecord?id=CVE-2026-39594).

Vendor
Themefic
Product
Ultra Addons for WPForms
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of Ultra Addons for WPForms versions <= 1.0.11 should update to a patched version to prevent potential exploitation of this vulnerability.

Technical summary

The vulnerability is a Broken Access Control issue, specifically allowing subscribers to perform unauthorized actions. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update Ultra Addons for WPForms to a version greater than 1.0.11.
  • Review and restrict subscriber permissions to prevent unauthorized actions.

Evidence notes

Evidence for this CVE was provided by Patchstack (see [ref-4](https://patchstack.com/database/wordpress/plugin/ultra-addons-for-wpforms/vulnerability/wordpress-ultra-addons-for-wpforms-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve)).

Official resources

CVE-2026-39594 was disclosed on June 15, 2026, and last modified on June 15, 2026.