[MEDIUM] Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

PKSA-xm2v-2qmq-bmd3 GHSA-cvpc-hccg-wmw4

Affected version: <3.1.28

Reported by:
GitHub

[CRITICAL] Formie Hidden field defaults vulnerable to Server-Side Template Injection

PKSA-rm1g-8q6b-7djk CVE-2026-52889 GHSA-565m-g33j-jq96

Affected version: <3.1.27

Reported by:
GitHub