{"id":"CVE-2026-105973","kind":"vulnerability","aliases":["CVE-2026-105973"],"related":[],"title":"Visual Form Builder WordPress plugin lets subscribers reorder any site's forms","description":"The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.","summary":"The Visual Form Builder WordPress plugin through 3.1 does not check authorization or nonces when reordering form fields. Any logged-in user, including the lowest Subscriber role, can change the field structure of any form on the site and break its public display.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","visual-form-builder","wordpress"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Visual Form Builder plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get visual-form-builder --field=version`\n- Confirm the installed version is `3.1` or earlier","fix":"- Update the Visual Form Builder plugin to a version later than `3.1`, if the sources name one: unknown\n- Until patched, restrict or disable subscriber accounts that can log in","status":"open","published_at":"2026-10-16T07:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:17+00:00","updated_at":"2026-10-25T04:41:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:41:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Visual Form Builder plugin to a version later than `3.1`, if the sources name one: unknown\n- Until patched, restrict or disable subscriber accounts that can log in","reach":"internet","title":"Visual Form Builder WordPress plugin lets subscribers reorder any site's forms","impact":"low","summary":"The Visual Form Builder WordPress plugin through 3.1 does not check authorization or nonces when reordering form fields. Any logged-in user, including the lowest Subscriber role, can change the field structure of any form on the site and break its public display.","category":"other","nicknames":[],"who_cares":["wordpress","visual-form-builder","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any logged-in user breaks public forms on the site","analyst_note":"Confirm the patched plugin version from the NVD entry or the plugin changelog; the sources do not name a fixed version.","how_to_check":"- Check whether the Visual Form Builder plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get visual-form-builder --field=version`\n- Confirm the installed version is `3.1` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the Visual Form Builder plugin at version 3.1 or earlier that allow user registration or have other authenticated low-privilege users. The attacker needs only a logged-in account, so exposure depends on whether such accounts exist. Sites without this plugin or with it at a patched version can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3307,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105973':15A,18A '-2026':14A,17A '3.1':35B,79C 'allow':91C 'alter':99C 'authent':93C 'author':39B,83C 'break':68B,110C 'builder':3A,26B,31B,75C 'chang':57B 'check':38B,86C 'cve':13A,16A 'display':71B 'field':45B,59B,90C,101C 'form':2A,12A,25B,30B,44B,63B,74C,89C,105C 'host':22B 'includ':51B 'let':6A 'log':48B 'logged-in':47B 'lowest':53B 'nonc':41B,85C 'perform':82C 'persist':109C 'plugin':5A,33B,77C 'public':70B,112C 'render':113C 'reorder':8A,43B,88C 'role':55B 'self':21B 'self-host':20B 'site':10A,66B,108C 'structur':60B,102C 'subscrib':7A,54B,95C 'user':50B,94C 'visual':1A,24B,29B,73C 'visual-form-build':23B 'wordpress':4A,27B,32B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Visual Form Builder plugin at version 3.1 or earlier that allow user registration or have other authenticated low-privilege users. The attacker needs only a logged-in account, so exposure depends on whether such accounts exist. Sites without this plugin or with it at a patched version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105973","severity":null,"published_at":"2026-10-16T07:17:08+00:00","modified_at":"2026-10-16T15:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}