---
id: CVE-2026-105973
title: >-
  Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via
  Missing Authorization
summary: >-
  The Visual Form Builder WordPress plugin through 3.1 does not perform
  authorization or nonce checks when reordering form fields, allowing any
  authenticated user (Subscriber and above) to alter the field structure of any
  form on the site,…
severity: none
cwe:
  - CWE-862
product: Visual Form Builder
affected:
  - visual_form_builder <= 3.1
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T06:00:13.742Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105973'
references:
  - url: 'https://wpscan.com/vulnerability/913ac6d0-a2bc-4739-b99d-dad3eb4d2336/'
tags:
  - cve.org
ingestedAt: '2026-10-16T07:01:11.489Z'
---

## Overview

The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.

## Affected

- `visual_form_builder <= 3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.