Executive brief
FormLayer is a WordPress plugin that allows administrators to create and manage web forms with notification and integration settings. The plugin fails to properly validate user permissions when returning form configuration data, allowing anyone on the internet to retrieve sensitive information such as email addresses, redirect URLs, and integration credentials by submitting a simple API request, even for forms that have never been published.
Technical details
The FormLayer plugin contains a sensitive data exposure vulnerability (CWE-200) in its form submission handler (wp-admin/admin-ajax.php?action=formlayer_submit_form). Although the plugin enforces nonce validation, it distributes the nonce to all unauthenticated visitors, rendering it useless as an access control mechanism. An attacker can extract a valid nonce from any page and submit it with an arbitrary form ID to retrieve the complete form configuration, including notification recipient addresses, reply-to and BCC email fields, confirmation redirect targets, and third-party integration settings. Unpublished drafts and forms never publicly displayed can be accessed by brute-forcing form IDs. The vulnerability requires only a valid nonce (publicly available) and network access; no authentication or user interaction is needed. The plugin developers have released version 1.0.9 with proper authorization checks.
Affected products
- FormLayer FormLayer before 1.0.9
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 1.0.9