CVE-2026-3546

creationtimestamp| type| source ---|---|--- 2026-03-31 18:56:04+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mieu4hq3rv2k...

CVE-2026-3546 e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshotformbuildergetaccountdata function is registered as a wpajax AJAX handler accessible to all authenticated users. The function lacks any capability che...