The forfront e-shot plugin for WordPress contains an AJAX handler that changes form field settings without checking user capabilities or validating a nonce. Because the handler is registered to the wp_ajax_ hook, any authenticated user, including those with Subscriber-level access or higher, can invoke it. This flaw allows an attacker to modify properties such as whether a field is mandatory, its visibility, or form display options. The vulnerability corresponds to CWE‑862, Missing Authorization.

WordPress sites that have any version of the forfront e-shot plugin up to and including 1.0.2 are affected. The issue resides in the plugin files admin/class-eshotformbuilder-admin.php and includes/class-eshotformbuilder.php. Site owners should verify the plugin version they have installed and upgrade if it is 1.0.2 or earlier.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits at this time. Nevertheless, once an account with any authentication level of Subscriber or higher is compromised, an attacker can readily exercise this vulnerability by sending an AJAX request to the eshot_form_builder_update_field_data action. The lack of authorization checks means the attack does not require any special conditions beyond user authentication.