CVE-2026-3546

CVE-2026-3546 describes a Sensitive Information Exposure vulnerability in the e-shot form builder plugin for WordPress, affecting all versions up to and including 1.0.2. An authenticated attacker, even with Subscriber-level access, can exploit an AJAX function lacking proper capability checks and nonce verification to extract the e-shot API token and subaccount data. This vulnerability carries a CVSS score of 5.3 (Medium), with a low attack complexity and the potential for unauthorized access to the victim's e-shot platform account. Currently, there is no indication of active exploitation, nor is public exploit code available through common platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are negligible.