What the vulnerability does
01Description
The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshot_form_builder_update_field_data() AJAX handler lacks any capability checks (current_user_can()) or nonce verification (check_ajax_referer()/wp_verify_nonce()). The function is registered via the wp_ajax_ hook, making it accessible to any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify form field configurations including mandatory status, field visibility, and form display preferences via the eshot_form_builder_update_field_data AJAX action.
Explanation of Vulnerability in Simple Terms
02Summary
E-shot versions 1.0.2 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data on the site. The vulnerability requires only network access and no user interaction. Integrity of site content is at risk, though confidentiality and availability are not directly affected.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication.
Potential impact on your site
04Site Impact
Attackers can alter site content, settings, or records without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 15, 2026
CVE published
April 16, 2026
Record updated
