CVE-2026-78151 — FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response

CVE-2026-78151

FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response PUBLISHED

Description (CNA)

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.

Affected (CNA)

Vendor / product	Versions
Unknown / FormLayer	affected 0 before 1.0.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ae844713-444f-43bc-9e1e-78f46e1545c7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.