The Visual Form Builder WordPress plugin through version 3.1 does not perform authorization checks when a user requests to move or reorder form fields. This missing permission enforcement allows any authenticated user with a Subscriber role or higher to modify the layout of any form on the site. The changes are persisted, breaking the public rendering of the form and potentially preventing users from submitting data or displaying form elements correctly. While the exploit does not provide remote code execution, it can result in a denial‑of‑service condition for form users and may lead to accidental information loss or mis‑behaviour of form logic.

All installations of the Visual Form Builder plugin running version 3.1 or earlier are affected. The vulnerability applies to any WordPress site using this plugin, regardless of other plugins or themes. No specific WordPress core versions are mentioned, so the risk remains for all supported WordPress releases that host the plugin.

The vulnerability can be exploited by any authenticated user with Subscriber or higher privileges. No nonce or other contextual checks are performed on the reordering request, making the attack straightforward once the user has logged in. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating there is currently no evidence of active exploitation. The CVSS score for this issue is 4.3, indicating a moderate severity, but the lack of role restriction and persistence of the change constitute a significant integrity and availability risk for the affected forms.