CVE-2022-0140 Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure

2022-04-1211:15:20

WPScan

www.cve.org

0.008 Low

EPSS

Percentile

82.0%

JSON

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Visual Form Builder",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.0.6"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336

www.fortiguard.com/zeroday/FG-VD-21-082

0.008 Low

EPSS

Percentile

82.0%

JSON

Related for CVELIST:CVE-2022-0140