# CVE-2026-59519: Softaculous FormLayer sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-59519-softaculous-formlayer-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-59519 · Severity: medium · CVSS 5.3 · Published 2026-07-05

Softaculous FormLayer, a WordPress plugin used for creating and managing forms, contains a security flaw that may expose sensitive information. An unauthorized individual could potentially view data that is intended to be hidden or restricted, which could lead to further security compromises. Users are advised to update to version 1.0.7 to resolve this issue.

Vendors: [Softaculous](https://junglewise.ai/threats/vendors/softaculous).

## Quick answers

**Is CVE-2026-59519 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59519 being exploited in the wild.

**How severe is CVE-2026-59519?** Medium severity, with a CVSS score of 5.3, published 5 July 2026.

**Which products and versions are affected?** Softaculous FormLayer up to 1.0.6.

**Is there a fix for CVE-2026-59519?** A patch was published on 2026-07-05: Version 1.0.7 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59519 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59519?** Check whether you run Softaculous FormLayer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Softaculous FormLayer plugin for WordPress (versions up to 1.0.6) is vulnerable to CWE-201: Insertion of Sensitive Information Into Sent Data. This flaw allows an unauthenticated remote attacker to retrieve sensitive data that is inadvertently embedded or included in the data sent by the application. The vulnerability is classified as a sensitive data exposure issue with a CVSS 3.1 base score of 5.3. The issue has been addressed in version 1.0.7.

## Affected products

- Softaculous FormLayer up to 1.0.6

## Timeline

- 2026-06-30: disclosed: Reported by Ananda Dhakal (Patchstack)
- 2026-07-05: advisory: Published by Patchstack and NVD
- 2026-07-05: patched: Version 1.0.7 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/formlayer/vulnerability/wordpress-formlayer-plugin-1-0-6-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/formlayer/vulnerability/wordpress-formlayer-plugin-1-0-6-sensitive-data-exposure-vulnerability?_s_id=cve)