The e-shot form builder plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in the eshot_form_builder_update_field_data() AJAX handler. This function is registered via the wp_ajax_ hook but does not perform any capability checks (e.g., current_user_can()) or nonce verification (e.g., check_ajax_referer()). Consequently, any authenticated user, including those with minimal privileges such as Subscribers, can invoke this AJAX action to alter form field configurations, including mandatory status, visibility, and display preferences. The vulnerability affects all versions up to and including 1.0.2. There is no vendor-provided patch or official remediation at this time.

The vulnerability allows authenticated users with Subscriber-level access or higher to modify form field configurations without proper authorization. This could lead to unauthorized changes in form behavior, potentially disrupting form functionality or user experience. There is no impact on confidentiality or availability reported. The integrity of form configuration data is affected at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and monitor for unauthorized changes to form configurations. Avoid granting unnecessary access to Subscriber-level accounts. No official fix or temporary workaround has been published by the vendor as of now.