CVE-2026-105974 — Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any au…
Published: 2026-10-16 · CVSS: 4.3 · CVSS 3.1
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7