Security Alert Summary
The e-shot form builder plugin for WordPress contains a missing authorization vulnerability in all versions up to and including 1.0.2. An AJAX handler, eshot_form_builder_update_field_data(), does not perform capability checks or nonce verification, allowing authenticated users to modify form field configurations such as mandatory status, field visibility, and form display preferences via the eshot_form_builder_update_field_data AJAX action.
CVE Details
- CVE ID: CVE-2026-3642
- Affected component: e-shot form builder plugin for WordPress
- Affected versions: All versions up to and including 1.0.2
- Published: April 15, 2026 at 9:16:31 AM UTC
- Last modified: April 15, 2026 at 9:16:31 AM UTC
- CVSS v3.1: Base Score 5.3, MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction:
- CVSS indicates Privileges Required: NONE and User Interaction: NONE.
- The plugin description notes the AJAX handler is registered via the
wp_ajax_hook and is accessible to authenticated users; Wordfence reports the action can be invoked by authenticated attackers with Subscriber-level access and above.
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW (ability to modify form field configurations)
- Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a missing authorization check in the AJAX handler eshot_form_builder_update_field_data(). The function does not call any capability checks (for example, current_user_can()) and does not verify nonces (for example, check_ajax_referer() or wp_verify_nonce()), so it lacks both permission and request authenticity validation.
The handler is registered via the WordPress wp_ajax_ hook, which makes the action reachable by authenticated users. Because the required checks are absent, an authenticated user with low-level access (the report specifies Subscriber-level and above) can invoke the eshot_form_builder_update_field_data AJAX action to change form field settings. The reported modifications include altering whether fields are mandatory, changing field visibility, and adjusting form display preferences.
The impact is limited to modification of form configuration data (integrity impact). There is no indication in the provided information that this vulnerability exposes sensitive stored data or directly affects site availability.
How This Could Impact Your Website
Consider a site with multiple WordPress accounts: a site owner, internal staff (editors or contributors), and external contractors or contributors with Subscriber-level access. An authenticated user with Subscriber access could use the vulnerable AJAX action to change form fields on public-facing or internal forms. Practical consequences include:
- Form fields that were required for validation being made optional, potentially allowing incomplete or malformed submissions.
- Fields being hidden or shown unexpectedly, causing user confusion or altering the data collected by forms used for contact, registration, or consent.
- Changes to form display preferences that could bypass intended UX or data-collection controls, increasing the risk of incorrect processing or administrative overhead to restore expected behavior.
These effects stem from integrity changes to form configuration rather than disclosure of stored secrets. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that do not require access to form configuration.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and form configuration changes for unusual behavior or unexpected modifications.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/admin/class-eshotformbuilder-admin.php#L656
- https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/includes/class-eshotformbuilder.php#L162
- https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/admin/class-eshotformbuilder-admin.php#L656
- https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/includes/class-eshotformbuilder.php#L162
- https://www.wordfence.com/threat-intel/vulnerabilities/id/815bd708-b2f8-4add-901b-863fbb3c4d81?source=cve
