CVE-2026-1867
Unauthorized Data Exposure in Guest Posting WordPress Plugin
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-1867 affects the WordPress plugin "WP Front User Submit" versions prior to 5.0.6 and involves an unauthenticated sensitive information exposure vulnerability.'}, {'type': 'paragraph', 'content': "The plugin allows a URL parameter to trigger regeneration of a .json file containing demo form data. If an administrator edits the demo form and enables admin notifications, an unauthenticated attacker can exploit this behavior to export and download all form data and settings, including the administrator's email address."}, {'type': 'list_item', 'content': 'An administrator edits the "First demo form" and activates admin notifications, then saves the form.'}, {'type': 'list_item', 'content': "An unauthenticated user accesses a URL such as https://example.com/?default_form_data=123, which regenerates the .json file based on the demo form's data."}, {'type': 'list_item', 'content': 'The attacker then downloads the regenerated JSON file from https://example.com/wp-content/plugins/front-editor/templates/default_form_data.json, gaining access to sensitive information.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability allows an unauthenticated attacker to access and download sensitive form data and settings from the affected WordPress plugin.'}, {'type': 'paragraph', 'content': "The attacker can obtain sensitive information including the administrator's email address, which could be used for further targeted attacks such as phishing or social engineering."}, {'type': 'paragraph', 'content': 'Exposure of form data and settings may lead to privacy breaches and compromise the security of the affected website.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking if the WordPress site is running the vulnerable plugin version prior to 5.0.6 and if the plugin's demo form has been edited with admin notifications enabled."}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your network or system, you can monitor HTTP requests for URL parameters like "default_form_data" which trigger regeneration of the JSON file.'}, {'type': 'paragraph', 'content': 'Example commands to detect such activity include:'}, {'type': 'list_item', 'content': 'Using web server logs (e.g., Apache or Nginx) to search for requests containing "default_form_data":\n grep "default_form_data" /var/log/apache2/access.log'}, {'type': 'list_item', 'content': 'Using curl to test if the vulnerable URL is accessible:\n curl -I "https://example.com/?default_form_data=123"'}, {'type': 'list_item', 'content': 'Checking if the JSON file is accessible and contains sensitive data:\n curl "https://example.com/wp-content/plugins/front-editor/templates/default_form_data.json"'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to update the WordPress plugin "WP Front User Submit" to version 5.0.6 or later, where this vulnerability is fixed.'}, {'type': 'paragraph', 'content': 'Additionally, review the plugin settings and disable admin notifications on the demo form if they are enabled and not necessary.'}, {'type': 'paragraph', 'content': 'Restrict access to the vulnerable JSON file path via web server configuration or security plugins to prevent unauthenticated downloads.'}] [1]