Visual Form Builder EUVD-2026-102688

Requires a valid authenticated session at Subscriber role or above - the lowest standard WordPress privilege level - which becomes trivially obtainable on sites that enable open user registration; exposure is much lower on sites that restrict account creation. The specific vulnerable operation is the form-field reordering action, which performs no capability (authorization) check and no nonce (CSRF) check, so any logged-in user can invoke it against any form. The flaw affects Visual Form Builder versions through 3.1; impact is limited to corrupting field structure and breaking public form rendering (integrity), with no data disclosure. The main limiting factors are the need for an authenticated account and the absence of any confidentiality or direct availability impact.

This is a genuine but low-to-moderate priority issue, not a critical one, and the available signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity, integrity-only flaw that requires an authenticated low-privilege account - matching CWE-862 (Missing Authorization) and the description's note that authorization and nonce checks are absent. The EPSS score of 0.14% (3rd percentile) indicates very low probability of near-term widespread exploitation, and CISA's SSVC framework reinforces this with Exploitation=none, Automatable=no, Technical Impact=partial. The flaw is NOT in CISA KEV, so there is no evidence of active exploitation; the only elevated signal is a publicly available WPScan proof-of-concept, which raises likelihood of opportunistic abuse but does not equal in-the-wild use. Impact is limited to integrity (I:L): an attacker can persistently corrupt form field ordering/structure and thereby break public rendering, but cannot read data (C:N) or directly take the site down (A:N, though broken form rendering is a functional nuisance). Net: a real, patch-worthy broken-access-control bug, but a low-urgency one - prioritize routine patching rather than emergency response.

On a WordPress site running Visual Form Builder (<=3.1) that allows open user registration, an attacker registers a free Subscriber account and submits a crafted field-reorder request lacking any authorization or nonce check. Because the plugin never verifies capability or CSRF token, the request succeeds and persistently scrambles the field structure of any targeted form, breaking its public display. A public proof-of-concept exists via WPScan, lowering the skill needed to reproduce the attack.