Live › vulnerability › CVE-2026-105973
Go to dashboardThe Visual Form Builder WordPress plugin through 3.1 does not check authorization or nonces when reordering form fields. Any logged-in user, including the lowest Subscriber role, can change the field structure of any form on the site and break its public display.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Visual Form Builder plugin at version 3.1 or earlier that allow user registration or have other authenticated low-privilege users. The attacker needs only a logged-in account, so exposure depends on whether such accounts exist. Sites without this plugin or with it at a patched version can skip it.
No product ranges from the sources yet.
wp plugin get visual-form-builder --field=version3.1 or earlier3.1, if the sources name one: unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
This page as .md · .json · in your agent: get_signal("CVE-2026-105973")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.