---
id: CVE-2026-12853
title: >-
  The Flamingo plugin for WordPress is vulnerable to authorization bypass in all
  versions up to, and including, 2.6.2
summary: >-
  The Flamingo plugin for WordPress is vulnerable to authorization bypass in all
  versions up to, and including, 2.6.2. This is due to the plugin not properly
  verifying that a user is authorized to perform an action. This makes it
  possible …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-862
vendor: rocklobsterinc
product: Flamingo
affected:
  - Flamingo <= 2.6.2
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T17:17:32.367'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12853'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.1/includes/capabilities.php#L5
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.1/includes/class-contact.php#L18
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.1/includes/class-contact.php#L27
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.1/includes/class-inbound-message.php#L29
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.1/includes/class-inbound-message.php#L46
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.2/includes/capabilities.php#L5
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.2/includes/class-contact.php#L18
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.2/includes/class-contact.php#L27
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.2/includes/class-inbound-message.php#L29
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/flamingo/tags/2.6.2/includes/class-inbound-message.php#L46
    label: security@wordfence.com
  - url: 'https://plugins.trac.wordpress.org/changeset/3611179/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/0e79a2b2-0491-4778-996d-0a0a80b2a338?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T16:37:12.541944Z'
epss: 0.0031
epssPercentile: 0.24003
ingestedAt: '2026-09-08T17:06:31.886Z'
---

## Overview

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate taxonomy terms including channel names derived from Contact Form 7 form titles that may reveal internal form purposes, department names, or workflow identifiers, as well as submission counts per channel and contact tag names. The plugin's flamingo_map_meta_cap() filter restricts access to Flamingo's admin UI but does not extend to WordPress core APIs such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.