CVE-2026-78151: FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/FormLayerto a version that resolves this vulnerability.Fixed in 1.0.9
Event History
Frequently Asked Questions
Which forms and data can be exposed?
The public submission handler can disclose the full stored configuration for forms, including unpublished forms. Exposed values include notification recipient addresses, confirmation redirect targets, and integration settings.
Does an attacker need to authenticate or have WordPress permissions?
No. The issue is exploitable by unauthenticated users because the submission handler returns form configuration without an authorization check.
Which plugin versions are affected?
FormLayer versions before 1.0.9 are affected. Updating to version 1.0.9 or later addresses the affected version range described.