PT-2026-33019 · Forfront · E-Shot

Phong Nguyen · Publicado 2026-04-15 · Atualizado 2026-04-24 · CVE-2026-3642

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshot form builder update field data() AJAX handler lacks any capability checks (current user can()) or nonce verification (check ajax referer()/wp verify nonce()). The function is registered via the wp ajax hook, making it accessible to any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify form field configurations including mandatory status, field visibility, and form display preferences via the eshot form builder update field data AJAX action.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-3642

Produtos afetados

E-Shot

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3642 · Nota de Segurança
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Publicação no Reddit
• https://wordfence.com/threat-intel/vulnerabilities/id/815bd708-b2f8-4add-901b-863fbb3c4d81?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/admin/class-eshotformbuilder-admin.php#L656 · Nota
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/includes/class-eshotformbuilder.php#L162 · Nota
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/includes/class-eshotformbuilder.php#L162 · Nota
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/admin/class-eshotformbuilder-admin.php#L656 · Nota