What is the CVSS score of CVE-2026-59519?

CVE-2026-59519 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

FormLayer CVE-2026-59519

EUVD-2026-41783 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-05 Patchstack

GHSA-j5vc-c5q7-5fjm

WordPress Information Disclosure Wordpress Plugin Formlayer Softaculous

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint leaks limited sensitive data; no integrity, availability, or scope-change impact supported by description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 22:17 vuln.today

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data.

This issue affects FormLayer: from n/a through 1.0.6.

AnalysisAI

Sensitive data exposure in Softaculous FormLayer WordPress plugin through version 1.0.6 allows remote unauthenticated attackers to retrieve embedded sensitive information from data transmitted by the plugin. The root cause (CWE-201) indicates the plugin inserts sensitive content - potentially API keys, tokens, or internal configuration - into outbound data visible to requesting clients. No public exploit code and no active exploitation have been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote accessibility.

Technical ContextAI

CWE-201 (Insertion of Sensitive Information Into Sent Data) describes a class of flaw where an application embeds sensitive material - such as credentials, session tokens, API keys, or private configuration - within data it transmits to clients or external services, where it can be intercepted or directly read. FormLayer is a WordPress form-builder plugin developed by Softaculous (CPE: cpe:2.3:a:softaculous:formlayer:*:*:*:*:*:*:*:*). In the context of a form plugin, this commonly manifests as sensitive server-side data being embedded in JavaScript-rendered form payloads, REST API responses, or HTML source visible in the browser. Because the CVSS vector specifies no required privileges or user interaction and a network attack vector, the exposure is likely present in publicly accessible form pages or plugin-registered endpoints rather than in admin-only interfaces.

RemediationAI

Update FormLayer to a version above 1.0.6 if a patched release has been published to the WordPress plugin repository or Softaculous directly. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/formlayer/vulnerability/wordpress-formlayer-plugin-1-0-6-sensitive-data-exposure-vulnerability for the confirmed patched version number, as the exact fix version is not confirmed in the available input data. If no patched version is yet available, deactivate the FormLayer plugin as an interim measure - this eliminates exposure at the cost of disabling form functionality. As a network-level compensating control, restrict access to plugin-registered REST API endpoints or form submission URLs using WAF rules or HTTP authentication; note this may break public-facing forms. Review any third-party API keys or credentials configured within the plugin and rotate them as a precaution, given the CWE-201 nature of this flaw.