CVE-2026-105974 in Visual Form Builder Plugin
Summary
by MITRE • 10/16/2026
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the Visual Form Builder WordPress plugin prior to version 3.1 represents a critical failure in access control mechanisms within the application's administrative interface. Specifically, the dashboard widget responsible for displaying recent form submissions lacks proper authorization checks before rendering data retrieved from the database. This architectural flaw allows any user with an authenticated account at the Subscriber level or higher to view sensitive information submitted by other users through forms created on the same WordPress installation. In typical WordPress environments, even low-privilege accounts such as Subscribers can often access certain administrative widgets if they are not properly secured, making this vulnerability particularly dangerous in multi-author sites where multiple individuals have varying levels of access but share the same backend environment.
From a technical perspective, the core issue lies in the absence of capability verification during the rendering process of the dashboard widget. When a user requests to view recent form submissions, the plugin retrieves data from its internal storage without verifying whether the requesting user has the specific permissions required to view that particular subset of data or any submission at all. This oversight results in an insecure direct object reference scenario where the application trusts the client-side request context rather than enforcing server-side access control policies. The flaw effectively bypasses the intended separation of duties, allowing lower-privileged users to escalate their effective privileges by accessing administrative-level information that should be restricted to editors or administrators who manage form configurations and user data compliance.
The operational impact of this vulnerability is significant due to the nature of the exposed data. Submissions typically contain personally identifiable information such as full names, email addresses, phone numbers, and potentially other sensitive details depending on the specific fields configured in each form. The exposure of contact information combined with timestamps and form titles can facilitate targeted phishing attacks, social engineering campaigns, or identity theft against individuals who submitted their data through these forms. Furthermore, for organizations subject to regulatory frameworks such as GDPR or HIPAA, this unauthorized disclosure constitutes a data breach that may require notification procedures and could result in legal penalties due to the failure to protect personal data adequately within the application's access control logic.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures where authorization checks are not performed before granting access to resources. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it exploits legitimate credentials of low-privileged users to gain unauthorized access to sensitive information. The attack vector is straightforward and does not require complex exploitation techniques; an attacker simply needs valid login credentials for any account with Subscriber privileges or higher on the targeted WordPress site. This simplicity increases the likelihood of successful exploitation in environments where password hygiene may be weak or where accounts are shared among multiple individuals.
Mitigation strategies should focus primarily on immediate patching and long-term architectural improvements. The most effective remediation is to upgrade the Visual Form Builder plugin to version 3.1 or later, where this authorization check has been implemented by the developers. For organizations unable to update immediately due to compatibility concerns with other plugins or themes, a temporary workaround involves restricting access to the WordPress dashboard entirely for Subscriber-level users if they do not require administrative capabilities. Additionally, implementing strict role-based access control policies and regularly auditing plugin code for proper capability checks can prevent similar vulnerabilities in future updates. Security monitoring should also be enhanced to detect unusual patterns of data retrieval from form submission tables by low-privileged accounts, providing an additional layer of defense against exploitation attempts.