CVE-2026-78151 Overview
CVE-2026-78151 is an information disclosure vulnerability in the FormLayer WordPress plugin before version 1.0.9. The plugin fails to perform authorization checks before returning a form's full stored configuration in the response to its public submission handler. Unauthenticated attackers can retrieve sensitive form data by interacting with the public submission endpoint. Exposed data includes notification recipient email addresses, confirmation redirect targets, and third-party integration settings. The disclosure extends to unpublished forms, meaning draft or hidden forms are also readable. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate form configurations, including recipient email addresses and integration credentials referenced in stored settings, for both published and unpublished forms.
Affected Products
- FormLayer WordPress plugin versions prior to 1.0.9
- WordPress installations with the vulnerable FormLayer plugin enabled
- Any site exposing the plugin's public form submission handler
Discovery Timeline
- 2026-09-02 - CVE-2026-78151 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78151
Vulnerability Analysis
The FormLayer plugin exposes a public submission handler that processes form data from site visitors. When the handler returns its response, it serializes and includes the target form's complete stored configuration rather than a minimal acknowledgment. Because no capability or ownership check gates this response, any unauthenticated request that references a form identifier receives the full configuration payload.
The configuration payload contains fields intended for site administrators, not end users. These fields include notification recipient email addresses, confirmation redirect URLs, and integration settings for third-party services such as CRM or email marketing platforms. Attackers can iterate through form identifiers to enumerate every form on the target site, including forms that have not been published.
Root Cause
The root cause is missing authorization on a public endpoint that returns privileged data. The submission handler treats form metadata as safe to echo back, when in fact the metadata represents administrator-only configuration. The plugin conflates the need for public write access on submissions with public read access on configuration.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker sends crafted requests to the plugin's public submission endpoint, referencing form identifiers sequentially or by discovery. The server responds with each form's full configuration. No authentication, user interaction, or elevated privileges are required. Full technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-78151
Indicators of Compromise
- Repeated unauthenticated POST requests to the FormLayer submission endpoint referencing sequential or enumerated form IDs
- Anomalous response sizes from the submission handler that indicate serialized configuration payloads rather than short acknowledgments
- Outbound scraping patterns from a single source IP targeting the plugin's AJAX or REST route
Detection Strategies
- Inspect web server access logs for high-volume requests to FormLayer submission routes and correlate response body sizes
- Deploy Web Application Firewall (WAF) rules that flag or block responses containing administrator email addresses or integration secrets on public endpoints
- Query for FormLayer plugin versions across managed WordPress fleets and alert on installations below 1.0.9
Monitoring Recommendations
- Monitor for unexpected disclosure of internal email addresses appearing in outbound HTTP responses
- Track plugin inventory changes and version drift across all WordPress sites
- Alert on rapid sequential access to form submission endpoints from a single client
How to Mitigate CVE-2026-78151
Immediate Actions Required
- Upgrade the FormLayer WordPress plugin to version 1.0.9 or later on all affected sites
- Rotate any credentials, API tokens, or webhook secrets stored in FormLayer integration settings if disclosure is suspected
- Audit notification recipient addresses and confirmation redirect targets for signs of tampering or reconnaissance
Patch Information
The vendor addressed the issue in FormLayer version 1.0.9 by adding authorization checks so the public submission handler no longer returns the full stored form configuration. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily deactivate the FormLayer plugin until the patched version is deployed
- Restrict access to the plugin's submission endpoint using WAF rules that filter administrator-only fields from responses
- Remove sensitive values such as long-lived API keys from stored integration settings until the upgrade completes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
