EUVD-2026-69844
GHSA-hfvq-fxjq-29rg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable public endpoint, no auth required, scope unchanged; confidentiality low as only configuration data (not full secrets with certainty) is exposed; no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
AnalysisAI
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running FormLayer before version 1.0.9. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects network reachability and no authentication requirement, but C:L understates the qualitative impact for sites whose form integration settings include API keys or webhook secrets for services like payment processors or CRMs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the FormLayer WordPress plugin to version 1.0.9 or later, which introduces proper authorization checks on the form configuration endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today