Description

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:18.160Z",
  "pubdate": "2026-09-02T06:17:18.160Z",
  "executiveSummary": "The FormLayer WordPress plugin, specifically in versions prior to 1.0.9, contains a critical Broken Access Control vulnerability that facilitates unauthorized information disclosure.\nThe vulnerability resides in the plugin's public submission handler, which fails to implement mandatory authorization checks before processing requests.\nThis flaw allows unauthenticated remote attackers to query and retrieve the complete, stored internal configuration of any form managed by the plugin, including those that remain unpublished.\nThe exposed data encompasses sensitive configuration details, such as notification recipient email addresses, confirmation redirect targets, and third-party integration settings.\nBy leveraging this information, an attacker can gain reconnaissance data that may be used to facilitate further targeted attacks, such as spear-phishing campaigns via discovered email addresses or the exploitation of secondary integrations.\nGiven that no authentication or elevated privileges are required, the risk is classified as high, as the vulnerability is readily exploitable over the network by any visitor to the site.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the public-facing API endpoint used by the FormLayer plugin for handling form submissions. The plugin fails to validate the request context or the authorization status of the caller before exposing configuration data.\nIn a standard secure implementation, an endpoint responsible for returning form configuration data should verify that the requester possesses the appropriate capabilities (such as 'manage_options' or specific plugin-level roles) before accessing sensitive object properties.\nIn the affected versions (prior to 1.0.9), the handler function responsible for the public submission process retrieves the full configuration object from the WordPress database and returns it in the response body without checking for an active session or a valid nonce.\nThe attack flow begins when an unauthenticated attacker sends a specially crafted request to the plugin's public submission handler. Because the endpoint does not enforce authorization, the plugin processes the request and executes the data retrieval logic.\nThe server responds by serializing the entire form configuration—which includes internal settings not intended for public consumption—into the response payload (typically JSON).\nThis leak provides attackers with a roadmap of the application's backend architecture. Specifically, the disclosure of 'notification recipient addresses' enables the identification of administrative contacts, while the disclosure of 'integration settings' may reveal API keys, Webhook URLs, or other sensitive configuration parameters used by the plugin to communicate with external services.\nThis information is particularly dangerous when it includes unpublished forms, as it reveals internal projects, hidden workflows, or administrative form structures that were intended to be kept private.\nBecause this information is available via standard HTTP requests, the attack can be automated to crawl a target site and scrape configurations for all available forms associated with the FormLayer plugin. The post-exploitation impact includes the potential for social engineering against disclosed email accounts, the interception of redirects, or the exploitation of vulnerable third-party services linked to the revealed integration settings."
}