CVE-2011-2676: The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plu...

Security readout for executives and security teams

This flaw affects old A-Form plug-ins for Movable Type. A logged-in user who is not an administrator may be able to change plug-in data because administrative authentication is not enforced. The source bundle does not provide CVSS, exploit details, or evidence of active exploitation. Exposure is limited to Movable Type deployments using the named A-Form plug-ins below the fixed version thresholds. Risk requires an authenticated remote user, but the sources do not define account types, deployment defaults, or exact affected data. Prioritize remediation if legacy Movable Type sites still use these plug-ins, especially where many users can authenticate. This is not supported as actively exploited by the supplied sources, but unauthorized data modification can affect business integrity. Mitigation focus: Inventory Movable Type sites for the affected A-Form plug-ins.; Upgrade A-Form and A-Form bamboo to 1.3.6 or later.; Upgrade A-Form 2.x to 2.0.3 or later..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.