medium4.3
CVE-2026-105973
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated use…
Impact
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
Affected products
| Product | Affected versions |
|---|---|
| Visual Form Builder WordPress Plugin | through 3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.