The e-shot form builder plugin for WordPress contains an issue where the function eshot_form_builder_get_account_data is exposed as an AJAX handler to all logged‑in users. The code does not perform any capability verification or nonce validation and reads the API token and subaccount data directly from the database, returning it as JSON. This allows an attacker who can log in as a Subscriber or higher to obtain credentials that could be used to compromise the victim’s e‑shot platform account. The weakness reflects the improper validation of user authority (CWE-202).

WordPress sites that have the Form Builder for e‑shot plugin installed with version 1.0.2 or any earlier release are affected. The vulnerability applies to all authenticated users, including those with Subscriber level access. All sites that rely on this plugin and have not upgraded beyond this release should review their configuration.

The CVSS score of 5.3 indicates a moderate severity vulnerability. An attacker only needs to be logged into the site with Subscriber or higher privileges, a common role for many users, and can simply invoke the AJAX endpoint to retrieve the token. Because the exploit requires no additional credentials and the code performs no security checks, the risk of compromise is considered high for any exposed token. EPSS information is not available, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog, but its ease of exploitation makes it a worthwhile concern for administrators.