CVE-2026-78151: CWE-200 Information Exposure in FormLayer

The FormLayer WordPress plugin versions prior to 1.0.9 contain an authorization bypass vulnerability that results in information disclosure (CWE-200). Specifically, the public submission handler endpoint returns the complete stored configuration of a form without verifying the requester's authorization. This exposure includes sensitive data like notification recipient email addresses, confirmation redirect targets, and integration settings, which could be leveraged to gather intelligence about the site's form configurations. The vulnerability affects all versions before 1.0.9. There is no vendor advisory or patch link provided in the data, and no known exploits in the wild have been reported.

An unauthenticated attacker can retrieve sensitive configuration details of forms managed by the FormLayer plugin, including notification recipients and integration settings. This information disclosure could aid attackers in crafting targeted phishing or social engineering attacks or in mapping the victim's infrastructure. However, the vulnerability does not allow modification or disruption of service, limiting the impact to confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the form submission handler or implementing additional access controls may reduce exposure.