CVEs-PoC/2022/CVE-2022-0140.md

CVE-2022-0140

Description

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

POC

Reference

• https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates