CVE-2026-105973 — Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

CVE-2026-105973

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization PUBLISHED

Description (CNA)

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

Affected (CNA)

Vendor / product	Versions
Unknown / Visual Form Builder	affected 0 through 3.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.