Title: Security issue Last modified: August 17, 2026 --- # Security issue * [Taisa – Raquel García Arévalo](https://wordpress.org/support/users/taisa1984/) * (@taisa1984) * [2 weeks, 4 days ago](https://wordpress.org/support/topic/security-issue-200/) * Hi, * We use this plugin in some sites and we have a warning from our tools that there’s a new vulnerability discovered * Info available in patchstack. * Thanks and best regards, * Taisa – Raquel García Arévalo Viewing 8 replies - 1 through 8 (of 8 total) * [Martin](https://wordpress.org/support/users/martinpwph/) * (@martinpwph) * [2 weeks ago](https://wordpress.org/support/topic/security-issue-200/#post-18999583) * Yes, this security notice came up for me in ManageWP also. * [Eagle](https://wordpress.org/support/users/techmagick/) * (@techmagick) * [1 week, 6 days ago](https://wordpress.org/support/topic/security-issue-200/#post-19000494) * 5 days and counting – is this plugin still supported ? * [https://patchstack.com/database/wordpress/plugin/styles-and-layouts-for-gravity-forms/vulnerability/wordpress-gravity-booster-8211-styles-amp-layouts-for-gravity-forms-plugin-6-0-broken-access-control-vulnerability](https://patchstack.com/database/wordpress/plugin/styles-and-layouts-for-gravity-forms/vulnerability/wordpress-gravity-booster-8211-styles-amp-layouts-for-gravity-forms-plugin-6-0-broken-access-control-vulnerability) * [imokweb](https://wordpress.org/support/users/imokweb/) * (@imokweb) * [1 week, 4 days ago](https://wordpress.org/support/topic/security-issue-200/#post-19001456) * HI there, please tell us when you fix this issue * thanks - This reply was modified 1 week, 4 days ago by [imokweb](https://wordpress.org/support/users/imokweb/). * [mgearh](https://wordpress.org/support/users/mgearh/) * (@mgearh) * [1 week, 3 days ago](https://wordpress.org/support/topic/security-issue-200/#post-19002831) * I am having the same security issue. Please. It’s been over a week. I already vibed my own fix for it. It wasn’t hard. * [shafk](https://wordpress.org/support/users/shafk/) * (@shafk) * [1 week, 3 days ago](https://wordpress.org/support/topic/security-issue-200/#post-19003005) * Think I may have to abandon using this plugin and style the forms myself using CSS * [MarkDenis](https://wordpress.org/support/users/markdenis/) * (@markdenis) * [1 week ago](https://wordpress.org/support/topic/security-issue-200/#post-19005716) * <= Version 6.1 – Broken Access Control * A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. * [ericreynolds007](https://wordpress.org/support/users/ericreynolds007/) * (@ericreynolds007) * [1 week ago](https://wordpress.org/support/topic/security-issue-200/#post-19005934) * [@mgearh](https://wordpress.org/support/users/mgearh/) How did you patch the plugin to fix the security issue? * [shafk](https://wordpress.org/support/users/shafk/) * (@shafk) * [2 days, 18 hours ago](https://wordpress.org/support/topic/security-issue-200/#post-19009695) * For anyone else waiting on a patch for CVE-2026-74004 (Broken Access Control, <= 6.1) – I dug into the plugin source and found the actual cause, and put together a workaround while we wait for an official fix. * **What’s wrong:** the plugin’s settings-save AJAX handlers correctly check current_user_can(‘ edit_posts’), but around a dozen of the read handlers (stla_styler_settings, stla_booster_settings, stla_anit_spam_settings, stla_form_fields_labels, and others) only check a nonce, not a capability. A nonce proves the request came from someone who saw it printed on a page — it isn’t an authorisation check on its own. Any logged-in user (Subscriber and up) who gets hold of a valid nonce can call these directly via admin-ajax.php and read booster/styler/anti-spam settings and form data. Matches what Patchstack flagged: low severity, info-disclosure only, no write access. * **Fix:** [https://gist.github.com/shafferk/aa07ac81276a87769d739c7da42ffcd3](https://gist.github.com/shafferk/aa07ac81276a87769d739c7da42ffcd3) * Drop that file into /wp-content/mu-plugins/ (create the folder if it doesn’t exist) on any site running this plugin. It runs on plugins_loaded, adds the same current_user_can(‘edit_posts’) check the plugin’s own save handlers already use, and wraps it around the handlers that were missing it. It survives plugin updates since mu-plugins aren’t touched by the updater, and it fails safe if a future plugin version changes these method names (it just skips patching that one action and logs a note, rather than breaking anything). * **Notes:** - This only covers the handlers I could confirm are missing the check in 6.1. If a future plugin version changes method names, check your error log after updating — the patch will skip silently rather than break your site. - Your scanner (Wordfence/Patchstack/WPScan/etc.) will keep flagging the site as vulnerable, since it checks the plugin’s version number, not actual behaviour. This closes the hole; it doesn’t change what’s reported. - This is a community stopgap, not an official patch – we still need to push WPMonks for a proper fix, and swap this out the moment they ship one. Viewing 8 replies - 1 through 8 (of 8 total) You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-issue-200%2F%3Foutput_format%3Dmd&locale=en_US) to reply to this topic. * ![](https://ps.w.org/styles-and-layouts-for-gravity-forms/assets/icon-256x256. png?rev=1352290) * [Gravity Booster - Styles & Layouts for Gravity Forms](https://wordpress.org/plugins/styles-and-layouts-for-gravity-forms/) * [Frequently Asked Questions](https://wordpress.org/plugins/styles-and-layouts-for-gravity-forms/#faq) * [Support Threads](https://wordpress.org/support/plugin/styles-and-layouts-for-gravity-forms/) * [Active Topics](https://wordpress.org/support/plugin/styles-and-layouts-for-gravity-forms/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/styles-and-layouts-for-gravity-forms/unresolved/) * [Reviews](https://wordpress.org/support/plugin/styles-and-layouts-for-gravity-forms/reviews/) * 10 replies * 8 participants * Last reply from: [shafk](https://wordpress.org/support/users/shafk/) * Last activity: [2 days, 18 hours ago](https://wordpress.org/support/topic/security-issue-200/#post-19009695) * Status: not resolved