rootpwn

medium · CVSS v3 4.3 · EPSS 0.00142

CVE-2026-105973

The Visual Form Builder WordPress plugin up to version 3.1 lacks proper authorization checks when reordering form fields. This allows any au

Overview

The Visual Form Builder WordPress plugin up to version 3.1 lacks proper authorization checks when reordering form fields. This allows any authenticated user with Subscriber role or higher to modify the field structure of any form on the site. The change persists and can break the public rendering of the form.

Description

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

Impact

Confidentiality: No direct data exposure. Integrity: The form structure can be altered, potentially causing incorrect data collection or user confusion. Availability: The public rendering of the form may break, denying access to users. Defenders: Site administrators and developers must ensure proper role checks and monitor form integrity.

Remediation

Upgrade Visual Form Builder to version 3.2 or later where authorization checks are added. If upgrade not possible, restrict form editing capabilities to Administrators only by adjusting role capabilities or using a role management plugin. Monitor form configurations for unexpected changes and audit logs for reordering actions. Disable the reordering feature via custom code or plugin settings if available.

Risk context

The vulnerability has a medium severity score (CVSS 4.3) and a very low EPSS of 0.00142, indicating it is unlikely to be widely exploited. However, any authenticated user can modify forms, so defenders should address it promptly to prevent potential disruption.

Affected products

  • WordPress
  • Visual Form Builder

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
0.00142

wordpress plugin authorization form medium epss defense

← All CVEs

Related CVEs

medium

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

View analysis

medium

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.

View analysis

medium

CVE-2026-109982

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.

View analysis

medium

CVE-2026-19798

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.

View analysis