CVE-2026-78151
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
| Vendor | unknown |
| Product | formlayer |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown formlayer
Be the first to know when new medium vulnerabilities affecting unknown formlayer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FormLayer
0 < 1.0.9
References
Credits
Vaibhav Narkhede WPScan