CVE-2022-0140

PoC —

CVSS 3.1

5.3 medium

EPSS

4%p90

Published

Apr 12, 2022 (Apr 12, 2022)

Modified

Jun 17, 2026

Description

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

Vendors: vfbpro
Products: visual form builder
Ecosystems: WordPress
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.8%)

In the news0 stories

No ingested article mentions this CVE yet.