What the vulnerability does
01Description
The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.
Explanation of Vulnerability in Simple Terms
02Summary
Forfront e-shot versions 1.0.2 and earlier contain an information disclosure vulnerability. An attacker on the network can read sensitive data without authentication or user interaction. The vulnerability has a CVSS score of 5.3, indicating moderate risk. Administrators should update to a version newer than 1.0.2 when available.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application without authentication.
Potential impact on your site
04Site Impact
Confidential data may be exposed to unauthenticated attackers over the network.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 21, 2026
CVE published
April 8, 2026
Record updated
