CVE-2022-0140: Vfbpro Visual Form Builder

Medium severity, CVSS 5.3. EPSS: 3.8% chance of exploitation in the next 30 days.

The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

Affected products

• Vfbpro Visual Form Builder: before 3.0.6 (fixed in 3.0.6)

Published 2022-04-12. Last modified 2026-06-17.