---
id: "CVE-2026-105973"
kind: "vulnerability"
aliases: ["CVE-2026-105973"]
title: "Visual Form Builder WordPress plugin lets subscribers reorder any site's forms"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "visual-form-builder", "wordpress"]
not_affected_if: ["no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-10-16T07:17:08+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105973", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Visual Form Builder WordPress plugin lets subscribers reorder any site's forms

The Visual Form Builder WordPress plugin through 3.1 does not check authorization or nonces when reordering form fields. Any logged-in user, including the lowest Subscriber role, can change the field structure of any form on the site and break its public display.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Visual Form Builder plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get visual-form-builder --field=version`
- Confirm the installed version is `3.1` or earlier

## Fix

- Update the Visual Form Builder plugin to a version later than `3.1`, if the sources name one: unknown
- Until patched, restrict or disable subscriber accounts that can log in

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105973

## From the sources

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_