What is the CVSS score of EUVD-2026-14178?

EUVD-2026-14178 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14178?

Organizations using for WordPress is vulnerable to Sensitive Information Exposure in all should be aware of moderate risk from CVE-2026-3546 rated CVSS 5.3.

How to fix or mitigate EUVD-2026-14178?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Sensitive Information Exposur and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress EUVD-2026-14178

| CVE-2026-3546 MEDIUM

Exposure of Sensitive Information Through Data Queries (CWE-202)

2026-03-21 Wordfence

GHSA-7m85-p686-23rm

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14178

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.

AnalysisAI

The e-shot form builder plugin for WordPress contains a sensitive information exposure vulnerability in the eshot_form_builder_get_account_data() AJAX handler that is accessible to any authenticated user without capability checks or nonce verification. An attacker with Subscriber-level access or higher can extract the e-shot API token and subaccount information by calling this AJAX endpoint, potentially compromising the victim's e-shot platform account. The vulnerability affects all versions up to and including 1.0.2, and while this CVE does not appear in the KEV catalog or have public proof-of-concept code readily available, the CVSS score of 5.3 reflects moderate risk due to the low attack complexity and lack of user interaction required.

Technical ContextAI

The vulnerability exists in the WordPress AJAX handler registration mechanism, specifically in the eshot_form_builder_get_account_data() function which is registered as a wp_ajax_ action accessible to authenticated users. The root cause is classified under CWE-202 (Exposure of Sensitive Information Through Data Queries), where the plugin directly queries the eshotformbuilder_control database table to retrieve stored e-shot API credentials without implementing WordPress capability checks (such as current_user_can('manage_options')) or CSRF token validation via wp_verify_nonce(). The affected product is the e-shot form builder plugin for WordPress, identified via CPE as cpe:2.3:a:forfront:e-shot. This represents a common WordPress security antipattern where AJAX endpoints intended for administrative use are inadvertently exposed to lower-privileged users due to missing authorization middleware.

RemediationAI

WordPress administrators using the e-shot form builder plugin should immediately upgrade to a patched version released after 1.0.2 when available; check the official plugin repository at https://plugins.wordpress.org/plugins/e-shot-form-builder/ for the latest security update. If a patch is not yet available, temporarily deactivate and remove the plugin until an update is released. As a temporary mitigation if the plugin is business-critical, restrict WordPress user registrations to prevent low-privilege account creation, enforce strict role-based access control to limit Subscriber-level accounts, and consider implementing a Web Application Firewall (WAF) rule to block requests to wp-admin/admin-ajax.php?action=eshot_form_builder_get_account_data. For additional defense, implement capability-checking patches by adding current_user_can('manage_options') checks and wp_verify_nonce() validation in custom code if source code modification is possible pending the official patch.