Vedrixa Forms <= 1.1.1 — Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 1.2.0, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Thanh Toan Bui.

The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the structure of any form — adding, removing, or altering fields — by writing attacker-controlled data to the plugin's FORMS database table. The 'ajax-nonce' nonce used by this handler is injected into the public frontend via wp_localize_script(), so any authenticated user who visits a page containing a form shortcode can obtain it without any elevated access.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. May 21, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated