.. / CVE-2022-0140

• Info Disclosure
• Nuclei
• Web

Exploit for WordPress Visual Form Builder <3.0.8 - Information Disclosure (CVE-2022-0140)

Description:

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint.

Nuclei Template

View the template here CVE-2022-0140.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0140.yaml

References: