CVE-2026-3546: e-shot Form Builder Information Disclosure

CVE-2026-3546 Overview

The e-shot form builder plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. Due to missing capability checks and nonce verification, any authenticated user with Subscriber-level access or above can extract the e-shot API token and subaccount information from the database.

Critical Impact

Authenticated attackers can extract e-shot API tokens and subaccount data, enabling unauthorized access to the victim's e-shot email marketing platform account.

Affected Products

• e-shot form builder plugin for WordPress version 1.0.2 and earlier

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-3546 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3546

Vulnerability Analysis

This vulnerability represents a classic case of broken access control in WordPress plugin development. The eshot_form_builder_get_account_data() function fails to implement proper authorization controls, creating a direct path for any authenticated user to access sensitive configuration data.

The vulnerable function is registered as a WordPress AJAX handler using the wp_ajax_ action hook, which makes it available to any logged-in user. The function directly queries the eshotformbuilder_control database table to retrieve the stored e-shot API token and returns it along with all subaccount data in a JSON response. This design flaw allows low-privileged users (Subscribers) to access administrative-level data that should only be available to users with the manage_options capability.

Root Cause

The root cause is the absence of two critical security controls in the AJAX handler:

1. Missing Capability Check: The function does not call current_user_can('manage_options') or any similar capability check to verify that the requesting user has administrative privileges.

2. Missing Nonce Verification: The function does not verify a nonce token using wp_verify_nonce() or check_ajax_referer(), which would help prevent both CSRF attacks and ensure the request originates from a legitimate WordPress session.

These missing controls allow any authenticated WordPress user to invoke the AJAX action and retrieve sensitive API credentials stored in the database.

Attack Vector

An attacker with any authenticated access to the WordPress site (even a basic Subscriber account) can exploit this vulnerability through the following attack flow:

The attacker authenticates to the WordPress installation with any valid user credentials, then crafts an AJAX request to the wp_ajax_eshot_form_builder_get_account_data action endpoint. The vulnerable function processes this request without verifying the user's capabilities and returns the e-shot API token and subaccount information as a JSON response.

With the extracted API credentials, the attacker can then access the victim's e-shot email marketing platform to perform unauthorized actions such as accessing contact lists, sending emails, or modifying account settings.

Detection Methods for CVE-2026-3546

Indicators of Compromise

• Unusual AJAX requests to admin-ajax.php with action parameter eshot_form_builder_get_account_data from non-administrator users
• Access logs showing requests to the plugin's AJAX endpoints from Subscriber or Contributor user sessions
• Unexpected access patterns to the e-shot email marketing platform from new IP addresses or locations
• Audit trail entries showing API token retrieval by low-privileged WordPress users

Detection Strategies

• Monitor WordPress AJAX request logs for access to eshot_form_builder_get_account_data action by non-administrator users
• Implement web application firewall rules to alert on suspicious parameter combinations targeting the vulnerable endpoint
• Review e-shot platform access logs for authentication from unexpected sources that may indicate token theft
• Enable WordPress security plugin logging to track AJAX action invocations and correlate with user privilege levels

Monitoring Recommendations

• Configure real-time alerting for AJAX requests to the vulnerable endpoint from accounts without administrative privileges
• Set up monitoring for the e-shot API to detect unusual authentication patterns or access from new IP addresses
• Review WordPress user registration and login activity for potential attacker account creation
• Monitor for bulk data exfiltration from the e-shot platform following potential credential theft

How to Mitigate CVE-2026-3546

Immediate Actions Required

• Deactivate and remove the e-shot form builder plugin version 1.0.2 or earlier from WordPress installations
• Rotate the e-shot API token immediately to invalidate any potentially compromised credentials
• Audit WordPress user accounts and remove any unauthorized Subscriber or low-privilege accounts
• Review e-shot platform access logs for unauthorized activity during the exposure window

Patch Information

As of the last NVD update on 2026-03-23, no official patch has been confirmed. Site administrators should monitor the Wordfence Vulnerability Report for updates on remediation status. Plugin source code can be reviewed at the WordPress Plugin Repository.

Workarounds

• Disable the e-shot form builder plugin until a patched version is released
• Restrict WordPress user registration to prevent attackers from obtaining authenticated access
• Implement web application firewall rules to block requests to the vulnerable AJAX action
• Consider using a different form builder plugin that has been audited for security vulnerabilities

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate e-shot-form-builder

# Or remove the plugin entirely
wp plugin delete e-shot-form-builder

# Audit current users with subscriber role
wp user list --role=subscriber --fields=ID,user_login,user_email,user_registered