CVE-2026-105974: Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

Q: Who can access the exposed submission data?

Any authenticated WordPress user with the Subscriber role or a higher-privileged role can view recent form submission data through the dashboard widget.

Q: What information may be disclosed?

The widget can expose other users' submitted contact information, including names, email addresses, form titles, and timestamps.

Q: What access does an attacker need to exploit this issue?

An attacker needs a valid authenticated WordPress account. No additional authorization check is performed before the dashboard widget displays recent submission data.

Q: Which plugin versions are affected?

Visual Form Builder versions through 3.1 are affected.

Published Oct 16, 2026

Updated

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

Affected Software

1 affected component

Visual Form Builder<=3.1

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can access the exposed submission data?

Any authenticated WordPress user with the Subscriber role or a higher-privileged role can view recent form submission data through the dashboard widget.

What information may be disclosed?

The widget can expose other users' submitted contact information, including names, email addresses, form titles, and timestamps.

What access does an attacker need to exploit this issue?

An attacker needs a valid authenticated WordPress account. No additional authorization check is performed before the dashboard widget displays recent submission data.

Which plugin versions are affected?

Visual Form Builder versions through 3.1 are affected.

CVE-2026-105974: Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

Affected Software

Event History

Frequently Asked Questions

Who can access the exposed submission data?

What information may be disclosed?

What access does an attacker need to exploit this issue?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can access the exposed submission data?

What information may be disclosed?

What access does an attacker need to exploit this issue?

Which plugin versions are affected?