CVE-2026-105974
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget. This allows any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
Risk Assessment
An unauthorized user can access personal and contact data submitted by other users, constituting a confidentiality breach and potential GDPR compliance issues.
Recommendation
Update the Visual Form Builder plugin to a version later than 3.1 when available. Until then, consider restricting user roles or disabling the dashboard widget.
Other vulnerabilities in Visual Form Builder WordPress plugin
Original NVD description (English source)
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS