The Visual Form Builder WordPress plugin does not perform an authorization check when displaying recent form submission data in a dashboard widget, allowing any authenticated user with the Subscriber role or higher to view other users’ submitted contact information. This includes names, email addresses, form titles and timestamps, exposing personal data and potentially violating privacy regulations. The underlying weakness is a lack of proper access control, leading to an information disclosure vulnerability.

The vulnerability affects the Visual Form Builder plugin for WordPress, with all versions up to and including 3.1 susceptible. No other vendor or product versions are named as affected in the CVE data.

Because the flaw requires only that the user be authenticated as a Subscriber or higher, a wide range of regular site users can exploit it. The attacker can access the dashboard widget and read the exposed data without requiring any special setup beyond a valid account. The EPSS score is less than 1%, indicating a very low but non-zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog; however its potential for misuse warrants attention.