CVE-2022-0140

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Unknown	Visual Form Builder	< 3.0.6

References

https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336Exploit, Third Party Advisory
https://www.fortiguard.com/zeroday/FG-VD-21-082Third Party Advisory
https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336Exploit, Third Party Advisory
https://www.fortiguard.com/zeroday/FG-VD-21-082Third Party Advisory

Timeline

Published: Apr 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-01418.1The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or CVE-2022-01429.8The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inje CVE-2022-01439.8When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP CVE-2022-01447.1shelljs is vulnerable to Improper Privilege Management CVE-2022-01455.4Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.CVE-2022-01476.1The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in att CVE-2022-01485.4The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on CVE-2022-01496.1The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the wo CVE-2022-01506.1The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its CVE-2022-01514.9An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14 CVE-2022-01526.5An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14 CVE-2022-01537.5SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.