← Back to the live CVE advisory feed

CVE-2026-76086: Product identification pending

Severity

8.5 (HIGH)

Affected versions

Before 2.2.23

Fixed version

2.2.23

Patch status

Patched

Published

2026-09-23T19:19:14.393

Modified

2026-09-23T19:19:14.393

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.

View the official NVD record for CVE-2026-76086

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.