CVE-2022-0140: unknown visual form builder
CVSS: 5.3v3.1MediumModified
Published 12-04-2022Last modified 02-08-2024
Vulnerability summary
CVE-2022-0140 is a medium (CVSS 5.3) vulnerability in unknown visual form builder. EPSS estimates a 3.84% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.0.6.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
3.84%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 12-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 2 agree
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
3.84%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.84% on 19-09-2026
19-09-202619-10-2026
EPSS score3.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Unknown1 product
- visual form builder< 3.0.6
Vfbpro1 product
- visual_form_builder< 3.0.6
Wordpress1 product
- visual-form-builder< 3.0.6
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336ExploitVDB EntryTechnical DescriptionThird Party Advisory
- www.fortiguard.com/zeroday/FG-VD-21-082Third Party Advisory