CVE-2026-105973

MediumCVSS 4.3/10Last modified Oct 16, 2026

Description

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Visual Form Builder	<= 3.1

References

https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059744.3The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data i CVE-2026-1059755.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and CVE-2026-1059764.7The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing CVE-2026-1059772.2The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment,CVE-2026-1059787.2Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system comman CVE-2026-1059797.2Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execut CVE-2026-1059807.2Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execu CVE-2026-1059817.2Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands a CVE-2026-1059827.2Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute t CVE-2026-1059858.8Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any CVE-2026-1059868.7Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a perce CVE-2026-1059875.1KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker c