---
id: CVE-2026-105973
title: >-
  The Visual Form Builder WordPress plugin through 3.1 does not perform
  authorization or nonce checks when reordering form fields, allowing any
  authenticated user (Subscriber and above) to alter the field structure of any
  form on the site,…
summary: >-
  The Visual Form Builder WordPress plugin through 3.1 does not perform
  authorization or nonce checks when reordering form fields, allowing any
  authenticated user (Subscriber and above) to alter the field structure of any
  form on the site,…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
product: Visual Form Builder
affected:
  - visual_form_builder <= 3.1
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:17:04.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105973'
references:
  - url: 'https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00185
epssPercentile: 0.0819
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:41:48.115149Z'
ingestedAt: '2026-10-16T07:01:11.489Z'
---

## Overview

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.