CVE-2026-16145 is an unauthenticated arbitrary options write vulnerability in a WordPress plugin that automates form builder integration. The root cause is not a missing validation check — it's a design decision to auto-populate an 'explicit-actions' list with common form builder identifiers at plugin activation, then accept writes to that list via unauthenticated admin-ajax.php requests.
The critical detail most miss: the attack surface doesn't disappear when the form builder is uninstalled. The explicit-actions entries persist in wp_options (or a custom table) indefinitely after the triggering plugin is removed. An attacker targeting this vulnerability doesn't need the form builder to be installed — they only need evidence that it was ever present on the site, which is trivial to enumerate for popular options like Contact Form 7, WPForms, or Ninja Forms.
Check your site's database for orphaned entries in the plugin's options table. Look for serialized arrays containing form builder slugs that are no longer active plugins. These represent permanent unauthenticated write paths that a patch cannot close — only manual cleanup removes them. If you previously used a form builder that you've since uninstalled, treat the plugin as actively vulnerable until you've purged that state.
The architectural problem: the convenience feature that makes this work — auto-population for seamless integration — fundamentally cannot be secured without redesigning the feature itself. Any fix that preserves 'zero configuration' will retain an unauthenticated write surface. The vendor must choose between breaking the UX or accepting the risk. Monitor the plugin's changelog for a version that ships with an empty explicit-actions list requiring manual activation — that's the only path to genuine remediation.