Live › vulnerability › CVE-2026-105974
Go to dashboardThe Visual Form Builder WordPress plugin through version 3.1 shows recent form submissions in a dashboard widget without checking the viewer's permissions. Any logged-in user, including the lowest-privilege Subscriber role, can read other people's names, email addresses, form titles and timestamps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Visual Form Builder plugin at version 3.1 or earlier that let users register or log in with the Subscriber role, since any logged-in account can view the submission data. Sites that do not allow public registration or that have no untrusted accounts are exposed only to their own staff.
No product ranges from the sources yet.
wp plugin get visual-form-builder --field=version or in the WordPress admin under Plugins; versions through 3.1 are affected.3.1 once a patched release is published; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
This page as .md · .json · in your agent: get_signal("CVE-2026-105974")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.