Description

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-07T13:18:04.133Z",
  "pubdate": "2026-09-07T13:18:04.133Z",
  "executiveSummary": "The Flamingo plugin for WordPress, in versions up to and including 2.6.2, is susceptible to an authorization bypass vulnerability. This flaw stems from inadequate access control validation within the plugin's security architecture.\nThe vulnerability allows authenticated users with at least contributor-level privileges to perform unauthorized enumeration of taxonomy terms. By bypassing the intended access restrictions, an attacker can extract sensitive metadata including internal contact form channel names, submission counts, and specific contact tag labels.\nThe risk implication is primarily informational disclosure; however, the data exfiltrated can provide attackers with structural insights into internal workflows, department nomenclatures, and contact management strategies, facilitating more targeted follow-on attacks against the WordPress environment.\nExploitation does not require elevated administrative privileges; standard authenticated users with contributor access are sufficient to leverage the identified exposure.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete implementation of the flamingo_map_meta_cap() filter. While this filter is designed to regulate access to the Flamingo administrative interface, it fails to enforce comprehensive security checks across WordPress core APIs.\nThe security mechanism exhibits a fragmented enforcement strategy, effectively protecting the plugin's proprietary UI while leaving WordPress core integration points, specifically XML-RPC (via the wp.getTerms method) and the admin-ajax (via the ajax-tag-search action), unprotected.\nBecause the plugin does not properly sanitize or verify authorization context when these core API requests are initiated, the internal taxonomy structures associated with Flamingo—which contain sensitive metadata derived from Contact Form 7 configurations—become accessible to any user with sufficient privileges to interact with these endpoints.\nThe attack flow proceeds as follows: An authenticated attacker possessing contributor-level access identifies the exposed XML-RPC or admin-ajax endpoints. By crafting specific requests aimed at these core APIs, the attacker invokes the taxonomy-related functions that Flamingo has registered. Because the authorization verification logic within flamingo_map_meta_cap() is not triggered or is bypassed by the nature of these core calls, the system returns unauthorized data.\nThe payload behavior involves the systematic enumeration of taxonomy terms. This results in the disclosure of 'channel' names, which correlate to form titles, providing the attacker with visibility into internal form purposes and organizational workflows. Furthermore, the attacker can retrieve submission counts linked to these channels and specific contact tag names, which may reveal internal department names or private segmentation strategies used by the site administrators.\nThis vulnerability is critical due to the ease of exploitation, as it requires only standard authenticated access and utilizes legitimate, built-in WordPress core functionality to circumvent intended security boundaries. The impact is a breach of information confidentiality, providing significant reconnaissance data that may be utilized for further exploitation of the WordPress site or organizational workflows."
}