CVE-2022-0140: vulnerability in Visual Form Builder
Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 3.8%
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Affected products
Unknown · Visual Form BuilderRelated CVEs — Visual Form Builder
In the same product, most dangerous first.
CVE-2022-0142—Visual Form Builder < 3.0.6 - CSV InjectionEPSS 2.9%CVE-2021-24514—Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1046—Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0141—Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRFEPSS 0.5%CVE-2026-105974MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetEPSS 0.2%CVE-2026-105973MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationEPSS 0.2%