Unauthorized Information Exposure in FormLayer Plugin for WordPress
CVE-2026-78151
Key Information:
Badges
What is CVE-2026-78151?
The FormLayer plugin for WordPress prior to version 1.0.9 is susceptible to an information exposure vulnerability. It fails to implement proper authorization checks when returning form configuration details through its public submission handler. As a result, unauthenticated users can gain access to sensitive information, such as notification recipient addresses, confirmation redirect targets, and integration settings, including those related to unpublished forms. This could potentially lead to further attacks or exploitation of the site's functionality.
Affected Version(s)
FormLayer 0 < 1.0.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.