CVE-2026-78151
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
- Score
- CVSS 3.1 5.3 Medium
- Status
- Deferred - contact@wpscan.com
- Published
- 2026-09-02
- Last modified
- 2026-09-02
- Weaknesses
- CWE-200
Affected products
References
- https://wpscan.com/vulnerability/ae844713-444f-43bc-9e1e-78f46e1545c7/
