CVE-2026-3546: 
WordPress vulnerability analysis and mitigation

CVE-2026-3546 is a Sensitive Information Exposure vulnerability in the e-shot Form Builder plugin for WordPress, affecting all versions up to and including 1.0.2. The flaw allows authenticated attackers with Subscriber-level access or higher to extract the site's e-shot API token and subaccount data via an unprotected AJAX endpoint. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, EUVD).

The root cause is a missing authorization check and absent nonce verification in the eshot_form_builder_get_account_data() function, classified under CWE-202 (Exposure of Sensitive Information Through Data Queries). This function is registered as a wp_ajax_ AJAX handler, making it accessible to any authenticated WordPress user regardless of role. It directly queries the eshotformbuilder_control database table and returns the e-shot API token along with all subaccount data as a JSON response, with no call to current_user_can() or any equivalent capability check. The vulnerable code is visible in the plugin's source at admin/class-eshotformbuilder-admin.php line 567 and registered in includes/class-eshotformbuilder.php line 163 (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to obtain the site owner's e-shot API token and all associated subaccount information, which could then be used to access and manipulate the victim's e-shot email marketing platform account. This exposes confidentiality of sensitive API credentials and potentially the contact lists, campaigns, and data managed within the e-shot platform. There is no direct integrity or availability impact on the WordPress site itself, but the stolen API token could enable unauthorized email campaigns, data harvesting, or account takeover on the external e-shot service (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Subscriber-level WordPress account, limiting the attack surface to sites that allow open user registration or where an attacker has already obtained low-privilege credentials (Wordfence).

1. Obtain Subscriber-level access: Register for an account on the target WordPress site (if open registration is enabled) or use previously compromised low-privilege credentials.
2. Identify the vulnerable AJAX action: Determine the WordPress AJAX endpoint URL, typically https://target-site.com/wp-admin/admin-ajax.php.
3. Craft the AJAX request: Send an authenticated POST request to the AJAX endpoint with the action parameter set to the registered handler name (e.g., action=eshot_form_builder_get_account_data), including the WordPress authentication cookies.
4. Receive API token: The server responds with a JSON object containing the e-shot API token and all subaccount data stored in the eshotformbuilder_control database table.
5. Leverage the API token: Use the extracted API token to authenticate directly to the e-shot platform API, enabling unauthorized access to the victim's email marketing account, contact lists, and campaign data (Wordfence, WordPress Trac).

• Network: Authenticated POST requests to /wp-admin/admin-ajax.php with the body parameter action=eshot_form_builder_get_account_data from low-privilege user sessions; unusual API calls to the e-shot platform originating from unexpected IP addresses.
• Logs: WordPress access logs showing repeated or anomalous requests to admin-ajax.php with the above action from Subscriber-level accounts; e-shot platform audit logs showing logins or API usage from unfamiliar IP addresses or at unusual times.
• File System: No direct file system artifacts expected from this information disclosure vulnerability.
• Process/Behavior: Unexpected e-shot account activity such as new campaigns, exported contact lists, or subaccount modifications following the suspicious AJAX requests.

WordPress site administrators should update the e-shot Form Builder plugin to a version beyond 1.0.2 if a patched release becomes available, or deactivate and remove the plugin until a fix is issued. As an interim workaround, restrict WordPress user registration to prevent untrusted users from obtaining Subscriber-level accounts. Additionally, rotate the e-shot API token immediately if exposure is suspected, and monitor the e-shot platform for unauthorized activity. Site owners should also review WordPress user accounts for any unexpected Subscriber-level registrations (Wordfence).