EUVD-2026-14178
GHSA-7m85-p686-23rm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.
AnalysisAI
The e-shot form builder plugin for WordPress contains a sensitive information exposure vulnerability in the eshot_form_builder_get_account_data() AJAX handler that is accessible to any authenticated user without capability checks or nonce verification. An attacker with Subscriber-level access or higher can extract the e-shot API token and subaccount information by calling this AJAX endpoint, potentially compromising the victim's e-shot platform account. The vulnerability affects all versions up to and including 1.0.2, and while this CVE does not appear in the KEV catalog or have public proof-of-concept code readily available, the CVSS score of 5.3 reflects moderate risk due to the low attack complexity and lack of user interaction required.
Technical ContextAI
The vulnerability exists in the WordPress AJAX handler registration mechanism, specifically in the eshot_form_builder_get_account_data() function which is registered as a wp_ajax_ action accessible to authenticated users. The root cause is classified under CWE-202 (Exposure of Sensitive Information Through Data Queries), where the plugin directly queries the eshotformbuilder_control database table to retrieve stored e-shot API credentials without implementing WordPress capability checks (such as current_user_can('manage_options')) or CSRF token validation via wp_verify_nonce(). The affected product is the e-shot form builder plugin for WordPress, identified via CPE as cpe:2.3:a:forfront:e-shot. This represents a common WordPress security antipattern where AJAX endpoints intended for administrative use are inadvertently exposed to lower-privileged users due to missing authorization middleware.
RemediationAI
WordPress administrators using the e-shot form builder plugin should immediately upgrade to a patched version released after 1.0.2 when available; check the official plugin repository at https://plugins.wordpress.org/plugins/e-shot-form-builder/ for the latest security update. If a patch is not yet available, temporarily deactivate and remove the plugin until an update is released. As a temporary mitigation if the plugin is business-critical, restrict WordPress user registrations to prevent low-privilege account creation, enforce strict role-based access control to limit Subscriber-level accounts, and consider implementing a Web Application Firewall (WAF) rule to block requests to wp-admin/admin-ajax.php?action=eshot_form_builder_get_account_data. For additional defense, implement capability-checking patches by adding current_user_can('manage_options') checks and wp_verify_nonce() validation in custom code if source code modification is possible pending the official patch.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today