CVE-2026-8692 — The Vedrixa Forms – User Registration Form, Signup Form &

title: CVE-2026-8692 - Vedrixa Forms Authorization Bypass - Form Structure Modification
id: scw-2026-05-22-ai-1
status: experimental
level: high
description: |
  Detects attempts to modify the structure of forms in the Vedrixa Forms plugin by targeting the 'vdform_save_form' AJAX action. This bypasses authorization checks, allowing authenticated users with subscriber-level access to alter form fields. This rule specifically looks for the AJAX endpoint and the action parameter associated with saving form data, indicating a potential exploitation of CVE-2026-8692.
author: SCW Feed Engine (AI-generated)
date: 2026-05-22
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8692/
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-method|exact: 
          - 'POST'
      cs-uri-query|contains:
          - 'action=vdform_save_form'
  selection_form_data:
      cs-uri-query|contains:
          - 'form_id='
      condition: selection AND selection_form_data
  condition: selection AND selection_form_data
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse