Visual Form Builder EUVD-2026-102689

Requires an authenticated WordPress account at Subscriber level or above (PR:L) on a site running Visual Form Builder plugin version ≤3.1; the attacker must be able to reach the wp-admin dashboard where the vulnerable recent-submissions widget renders. The specific feature at fault is the dashboard widget that displays recent form submission data without performing an authorization/capability check. Limiting factors: exploitation is impossible without a valid low-privilege account, so sites that disable open user registration or do not grant dashboard access to untrusted users are not realistically exposed; impact is confined to read-only disclosure of names, email addresses, form titles and timestamps (no write, no takeover). No user interaction is required (UI:N).

This is a genuinely low-priority vulnerability despite being a real flaw, and the multiple signals are consistent rather than conflicting. The CVSS 3.1 base score of 4.3 (Medium) is driven by network vector (AV:N) and low complexity (AC:L) but is correctly held down by PR:L (an authenticated Subscriber account is required) and limited impact (C:L/I:N/A:N - read-only disclosure of non-sensitive contact fields). EPSS reinforces low real-world urgency at 0.15% (4th percentile), and the CVE is NOT in CISA KEV (exploitation status: none per SSVC). SSVC further rates it Automatable: no and Technical Impact: partial, meaning there is no reliable path to mass automated exploitation. The one elevating signal is that publicly available exploit code exists (WPScan), but POC availability is distinct from active exploitation and does not change the picture here. Net: a WordPress site that allows open/low-privilege user registration faces a plausible but minor information-disclosure risk; sites that do not grant Subscriber accounts to untrusted users face negligible risk. All signals agree this is a low-severity, low-likelihood issue, not a high-CVSS/low-real-risk mismatch.

An attacker who holds or self-registers a low-privilege Subscriber account on a WordPress site running Visual Form Builder ≤3.1 logs into the admin dashboard and views the plugin's recent-submissions dashboard widget, which omits any authorization check. They harvest other users' submitted names, email addresses, form titles and timestamps. A public POC exists (WPScan), and because the vector is network-based with low complexity, exploitation is trivial once the attacker has any authenticated session.