WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Arbitrary Form Field Reordering vulnerability

Subscriber+ Arbitrary Form Field Reordering vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Visual Form Builder versions = 3.1...

CVE-2026-105973

The Visual Form Builder WordPress plugin (versions

EUVD-2026-102688

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...