Description

Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T15:17:09.027Z",
  "pubdate": "2026-08-18T15:17:09.027Z",
  "executiveSummary": "A broken access control vulnerability exists in the Gravity Booster – Styles & Layouts for Gravity Forms plugin affecting versions <= 6.0. The flaw allows authenticated users with low-privileged accounts, specifically the Subscriber role, to perform unauthorized actions restricted to higher-privileged administrators or users. This security deficiency arises from insufficient authorization checks within the plugin's functionality, enabling unauthorized manipulation of settings or data handled by the component. The impact of this vulnerability includes potential unauthorized modifications, privilege abuse, and integrity compromise within the WordPress application where the vulnerable plugin is installed. Attackers possessing low-privileged Subscriber access can exploit this weakness without requiring complex interaction, leveraging the lack of proper capability verification in the affected request handlers. The risk implications are significant for platforms relying on strict role-based access control, as unauthorized users can bypass intended security boundaries. Remediation requires updating the affected product to a patched version beyond 6.0 or applying vendor-supplied hardening measures to enforce proper capability checks.",
  "technicalDetails": "The vulnerability is classified as a Broken Access Control issue residing within the Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress, specifically impacting all versions up to and including 6.0. The root cause stems from the application logic failing to properly validate user roles and capabilities prior to executing sensitive administrative functions or processing state-changing requests. Specifically, the request handlers responsible for handling specific plugin actions omit rigorous checks such as current_user_can() or equivalent permission verifications, or they rely solely on client-side controls or weak nonce checks that can be bypassed by authenticated low-privileged users.\nThe attack flow begins when an authenticated attacker with a restricted role, such as a Subscriber, interacts with the vulnerable endpoints exposed by the plugin. Because the backend code fails to adequately verify whether the requesting user possesses administrative privileges, the server processes the incoming requests and executes the associated administrative functionality. Depending on the exposed functions, the payload behavior may include unauthorized modification of form styling parameters, global layout configurations, or other stored data managed by the plugin.\nAuthentication is required to exploit this vulnerability, as the attacker must possess at least a standard Subscriber-level account on the target WordPress installation. No special privileges beyond standard user registration are necessary. The attack vector is network-based, leveraging HTTP requests directed to the WordPress AJAX or REST API endpoints associated with the plugin. Post-exploitation impact encompasses the degradation of application integrity, unauthorized alteration of form layouts, and potential chaining with other vulnerabilities if administrative interface states are improperly exposed or modified."
}