Exploitation Research Plan: CVE-2026-59519 (FormLayer Information Exposure)

1. Vulnerability Summary

The FormLayer plugin for WordPress (versions <= 1.0.6) is vulnerable to Sensitive Information Exposure due to an insecure implementation of the wp_localize_script function in the frontend. The plugin passes the entire contents of the formlayer_settings WordPress option to the frontend as part of the formlayer_data JavaScript object. This option contains global plugin configurations, including sensitive credentials such as hCaptcha secret keys and potentially other third-party integration keys (Mailchimp, Slack, etc., in Pro versions).

Since the script and its localized data are enqueued on any page containing a FormLayer shortcode, an unauthenticated attacker can extract these secrets by simply visiting such a page and inspecting the global JavaScript variables.

2. Attack Vector Analysis

• Vulnerable Endpoint: Any public-facing page or post containing the [formlayer] shortcode.
• Vulnerable Mechanism: wp_localize_script in main/frontend.php.
• Payload Location: The HTML source code of the rendered page, specifically within a <script> tag defining the formlayer_data object.
• Authentication: Unauthenticated (No login required).
• Preconditions:
  1. The plugin must be active.
  2. At least one page must contain the [formlayer] shortcode to trigger asset enqueuing.
  3. Sensitive data (like hCaptcha keys) must be saved in the plugin settings.

3. Code Flow

1. Initialization: In formlayer.php, formlayer_load_plugin() is hooked to plugins_loaded.
2. Hook Registration: formlayer_load_plugin() hooks \FormLayer\Frontend::init to the init hook.
3. Frontend Init: \FormLayer\Frontend::init (in main/frontend.php) hooks \FormLayer\Frontend::enqueue_assets to wp_enqueue_scripts.
4. Information Leakage: The enqueue_assets() function executes the following:

   wp_localize_script('formlayer-frontend', 'formlayer_data', [
       'ajax_url' => admin_url('admin-ajax.php'),
       'nonce' => wp_create_nonce('formlayer-frontend'),
       'messages' => get_option('formlayer_settings', []), // <--- VULNERABLE: Entire settings array leaked
       'is_pro' => defined('FORMLAYER_PRO_VERSION') ? true : false,
   ]);
   

5. Data Persistence: As seen in main/ajax.php, the save_settings() method saves sensitive keys like captcha_h_secret_key into the formlayer_settings option array.
6. Exposure: WordPress renders this data in the HTML:
   var formlayer_data = {"ajax_url":"...","nonce":"...","messages":{"captcha_h_secret_key":"SECRET_VALUE",...},...};

4. Nonce Acquisition Strategy

This vulnerability is an information exposure that does not require a nonce to trigger. However, the exposed formlayer_data object contains a valid nonce for the formlayer-frontend action, which can be used to interact with the formlayer_submit_form AJAX endpoint.

To extract the leaked data and the nonce via the security agent:

1. Create a page with the shortcode [formlayer id="1"] (or any valid form ID).
2. Navigate to the page using browser_navigate.
3. Execute JavaScript to retrieve the localized object:
   browser_eval("window.formlayer_data")
4. The sensitive keys will be located in the .messages property of the returned object.

5. Exploitation Strategy

Step-by-Step Plan:

1. Configuration: Update the formlayer_settings option with a "canary" secret key to simulate a configured environment.
2. Target Creation: Create a formlayer_form post and a public page containing the corresponding shortcode.
3. Extraction: Navigate to the public page as an unauthenticated user.
4. Payload: Execute browser_eval("window.formlayer_data.messages").
5. Verification: Parse the JSON output and confirm the presence of the "canary" secret key.

6. Test Data Setup

Run these WP-CLI commands to prepare the environment:

# 1. Set a sensitive canary value in settings
wp option update formlayer_settings '{"captcha_h_secret_key":"CVE-2026-59519-CANARY-SECRET", "captcha_h_site_key":"site-key-123"}' --format=json

# 2. Create a dummy form (needed for the shortcode to render)
FORM_ID=$(wp post create --post_type=formlayer_form --post_title="Leak Test Form" --post_status=publish --post_content='{"fields":[{"type":"text","label":"Name"}]}' --porcelain)

# 3. Create a public page with the shortcode
wp post create --post_type=page --post_title="Contact Us" --post_status=publish --post_content="[formlayer id=\"$FORM_ID\"]"

7. Expected Results

• The browser_eval call to window.formlayer_data should return an object.
• The messages property of that object should contain a key-value pair: "captcha_h_secret_key": "CVE-2026-59519-CANARY-SECRET".
• The nonce property should contain a 10-character WordPress nonce.

8. Verification Steps

After the exploit attempt, verify the results against the database state:

# Check the value in the database to ensure the leaked data matches
wp option get formlayer_settings --format=json

If the output of browser_eval matches the output of wp option get, the information exposure is confirmed.

9. Alternative Approaches

If the [formlayer] shortcode does not render or enqueue scripts due to missing form data, try targeting the render_shortcode logic in main/frontend.php.

• Fallback Rendering: If the form content is not valid JSON, the plugin falls back to render_form_fallback.
• Direct Script Check: Even if the form HTML is broken, if wp_enqueue_script('formlayer-frontend', ...) is called, the formlayer_data object will be present in the page head or footer. Check the page source for the string formlayer_data even if browser_eval fails initially.