WP Front User Submit < 5.0.6 – Unauthenticated Sensitive Information Exposure | CVE 2026-1867

Description

The plugin allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the plugin's settings, it is possible for an unauthenticated attacker to export and download all of the form data/settings, including the administrator's email address.

Proof of Concept

1) Edit the "First demo form" as an administrator and activate admin notifications, save the form.
2) As an unauthenticated user, access https://example.com/?default_form_data=123, which regenerates the .json file based on existing data in the demo form's post. Passing a value is not necessary, but can be done to bust cache. 
3) As an unauthenticated user, access https://example.com/wp-content/plugins/front-editor/templates/default_form_data.json to download.