CVE-2026-78151
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Aug 23, 2026
Description
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
FormLayerUnknown |
|
References
- https://wpscan.com/vulnerability/ae844713-444f-43bc-9e1e-78f46e1545c7/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.