PT-2026-33019 · Forfront · E-Shot

Phong Nguyen · Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-3642

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshot form builder update field data() AJAX handler lacks any capability checks (current user can()) or nonce verification (check ajax referer()/wp verify nonce()). The function is registered via the wp ajax hook, making it accessible to any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify form field configurations including mandatory status, field visibility, and form display preferences via the eshot form builder update field data AJAX action.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3642

Affected Products

E-Shot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-3642 · Security Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/includes/class-eshotformbuilder.php#L162 · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/includes/class-eshotformbuilder.php#L162 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/815bd708-b2f8-4add-901b-863fbb3c4d81?source=cve · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/admin/class-eshotformbuilder-admin.php#L656 · Note
• https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/admin/class-eshotformbuilder-admin.php#L656 · Note