CVE-2026-3546Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-202

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-03-21); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-21	2	Disclosure2
2026-03-31	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF191d
PoC
https://atomicedge.io/cve-proof/cve-2026-3546-e-shot-form-builder-version-1-0-2-medium-vulnerability-proof-of-concept CVE-2026-3546 #WordPress plugin #vulnerability e-shot-form-builder https://atomicedge.io/?p=6571 #cybersecurity #wordpressfirewall #wordpresssecurity #hacking …
Post summary
The post advertises a proof‑of‑concept for CVE‑2026‑3546 in the e‑shot‑form‑builder WordPress plugin, linking to a detailed PoC but providing no exploit code, mitigation, or evidence of active exploitation.
02020198
9 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds201d
Disclosure
CVE-2026-3546 Sensitive Information Exposure in WordPress E-Shot Form Builder Plugin via Unauthenticated API Token Retrieval https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3546
Post summary
The post announces a CVE describing sensitive information exposure in the E‑Shot plugin caused by unauthenticated API token retrieval, without any PoC, exploit, or fix details.
0000068
4.0K followersView on X
CVE@CVEnew201d
Disclosure
CVE-2026-3546 The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_acc… https://www.cve.org/CVERecord?id=CVE-2026-3546
Post summary
A new CVE (CVE-2026-3546) for the e-shot form builder plugin in WordPress is disclosed, noting sensitive information exposure in all versions up to 1.0.2; no additional details such as exploits, patches, or PoC are provided.
0000098
56.8K followersView on X

Explore more

Back to dashboard