Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2026-105974 The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent…

Description

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

Produits et versions touchés

Produit Versions touchées Corrigé en
Visual Form Builder 3.1 premières → 3.1 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Visual Form Builder

Les 7 CVE de Visual Form Builder →
CVE-2026-105973 The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form… 4.3 Moyenne CVE-2022-1046 The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which… Non notée CVE-2022-0142 The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or… Non notée CVE-2022-0141 The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to… Non notée
Suivre cette CVE