CVE-2026-105973: Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user Subscriber and above to alter the field structure of any form on the site, persistently breaking its public rendering...

PT-2026-115468

Name of the Vulnerable Software and Affected Versions Visual Form Builder versions prior to 3.2 Description The plugin fails to perform authorization or nonce checks when reordering form fields. This allows any authenticated user with the Subscriber role or higher to modify the field structure of...