Gutena Forms WordPress Plugin Arbitrary Options Update Vulnerability

A vulnerability exists in the Gutena Forms WordPress plugin in versions prior to 1.6.1, where the plugin fails to properly validate options before they are updated. This flaw enables users with Contributor roles and above to modify arbitrary boolean and array options, such as 'users_can_register'.

Impact

Exploitation of this vulnerability allows for unauthorized modification of specific WordPress options, which could lead to broader security issues depending on the options changed.

Reproduction

To reproduce this vulnerability, a user with a Contributor role can insert a specific Gutena Forms block into a post. This block can be configured to target the 'users_can_register' option, effectively changing its value.

Remediation

Users are advised to update the Gutena Forms WordPress plugin to version 1.6.1 or later.