CVE-2026-105973

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

Affected

Visual Form Builder

CVSS v3.1 CISA-ADP

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 8th percentile

Published

2026-10-16

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/

References

• CVE Record
• NVD entry