Formlayer
Monthly
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Sensitive data exposure in Softaculous FormLayer WordPress plugin through version 1.0.6 allows remote unauthenticated attackers to retrieve embedded sensitive information from data transmitted by the plugin. The root cause (CWE-201) indicates the plugin inserts sensitive content - potentially API keys, tokens, or internal configuration - into outbound data visible to requesting clients. No public exploit code and no active exploitation have been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote accessibility.
FormLayer WordPress plugin before version 1.0.9 discloses full form configuration data to unauthenticated users through its public submission handler, which performs no authorization check before returning stored settings. Notification recipient email addresses, confirmation redirect targets, and third-party integration credentials are exposed for all forms - including unpublished drafts invisible to end users. A public exploit exists via WPScan, and a vendor patch is available at version 1.0.9.
Sensitive data exposure in Softaculous FormLayer WordPress plugin through version 1.0.6 allows remote unauthenticated attackers to retrieve embedded sensitive information from data transmitted by the plugin. The root cause (CWE-201) indicates the plugin inserts sensitive content - potentially API keys, tokens, or internal configuration - into outbound data visible to requesting clients. No public exploit code and no active exploitation have been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote accessibility.