Missing Authorization Vulnerability in e-shot™ Form Builder Plugin for WordPress

CVE-2026-3642

What is CVE-2026-3642?

The e-shot™ Form Builder Plugin for WordPress contains a vulnerability that permits unauthorized modification of form fields by authenticated users. This vulnerability arises from the absence of capability checks and nonce verification in the eshot_form_builder_update_field_data() AJAX handler. Consequently, any user with Subscribe-level access or higher can alter the configurations of form fields, affecting their mandatory status, visibility, and display settings. This lack of access control could lead to potential misuse of forms and data exposure, making updates and proper security practices essential for safeguarding users and maintaining the integrity of forms.

References