PT-2026-26858 · Forfront · E-Shot

Phong Nguyen · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-3546

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot form builder get account data() function is registered as a wp ajax AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current user can('manage options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.

Fix

Weakness Enumeration

CWE-202

Related Identifiers

CVE-2026-3546

Affected Products

E-Shot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3546 · Security Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/includes/class-eshotformbuilder.php#L163 · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/admin/class-eshotformbuilder-admin.php#L567 · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/includes/class-eshotformbuilder.php#L163 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/965bb642-4472-491f-8378-f4331ba4ab7c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/admin/class-eshotformbuilder-admin.php#L567 · Note