CVE-2026-105973: medium-severity vulnerability in Visual Form Builder
Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
exploitation probability
0.2%top 92% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Visual Form Builderpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Visual Form Builder
In the same product, most dangerous first.
CVE-2022-0140—Visual Form Builder < 3.0.6 - Unauthenticated Information DisclosureEPSS 3.8%CVE-2022-0142—Visual Form Builder < 3.0.6 - CSV InjectionEPSS 2.9%CVE-2021-24514—Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1046—Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0141—Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRFEPSS 0.5%CVE-2026-105974MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetEPSS 0.2%