[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo5BMqAf89Tagp_IQsUYpwYmbvzzksa_QVcBUZtDYjQo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-59519","formlayer-unauthenticated-information-exposure","FormLayer \u003C= 1.0.6 - Unauthenticated Information Exposure","The FormLayer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.","formlayer",null,"\u003C=1.0.6","1.0.7","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-05 00:00:00","2026-07-08 19:50:10",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F988c30f7-5f04-4ee5-b3d5-0dd66d23e1cc?source=api-prod",4,[22,23,24,25],"formlayer.php","main\u002Fajax.php","main\u002Ffrontend.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-59519 (FormLayer Information Exposure)\n\n## 1. Vulnerability Summary\nThe FormLayer plugin for WordPress (versions \u003C= 1.0.6) is vulnerable to **Sensitive Information Exposure** due to an insecure implementation of the `wp_localize_script` function in the frontend. The plugin passes the entire contents of the `formlayer_settings` WordPress option to the frontend as part of the `formlayer_data` JavaScript object. This option contains global plugin configurations, including sensitive credentials such as **hCaptcha secret keys** and potentially other third-party integration keys (Mailchimp, Slack, etc., in Pro versions). \n\nSince the script and its localized data are enqueued on any page containing a FormLayer shortcode, an unauthenticated attacker can extract these secrets by simply visiting such a page and inspecting the global JavaScript variables.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** Any public-facing page or post containing the `[formlayer]` shortcode.\n*   **Vulnerable Mechanism:** `wp_localize_script` in `main\u002Ffrontend.php`.\n*   **Payload Location:** The HTML source code of the rendered page, specifically within a `\u003Cscript>` tag defining the `formlayer_data` object.\n*   **Authentication:** Unauthenticated (No login required).\n*   **Preconditions:** \n    1.  The plugin must be active.\n    2.  At least one page must contain the `[formlayer]` shortcode to trigger asset enqueuing.\n    3.  Sensitive data (like hCaptcha keys) must be saved in the plugin settings.\n\n## 3. Code Flow\n1.  **Initialization:** In `formlayer.php`, `formlayer_load_plugin()` is hooked to `plugins_loaded`.\n2.  **Hook Registration:** `formlayer_load_plugin()` hooks `\\FormLayer\\Frontend::init` to the `init` hook.\n3.  **Frontend Init:** `\\FormLayer\\Frontend::init` (in `main\u002Ffrontend.php`) hooks `\\FormLayer\\Frontend::enqueue_assets` to `wp_enqueue_scripts`.\n4.  **Information Leakage:** The `enqueue_assets()` function executes the following:\n    ```php\n    wp_localize_script('formlayer-frontend', 'formlayer_data', [\n        'ajax_url' => admin_url('admin-ajax.php'),\n        'nonce' => wp_create_nonce('formlayer-frontend'),\n        'messages' => get_option('formlayer_settings', []), \u002F\u002F \u003C--- VULNERABLE: Entire settings array leaked\n        'is_pro' => defined('FORMLAYER_PRO_VERSION') ? true : false,\n    ]);\n    ```\n5.  **Data Persistence:** As seen in `main\u002Fajax.php`, the `save_settings()` method saves sensitive keys like `captcha_h_secret_key` into the `formlayer_settings` option array.\n6.  **Exposure:** WordPress renders this data in the HTML:\n    `var formlayer_data = {\"ajax_url\":\"...\",\"nonce\":\"...\",\"messages\":{\"captcha_h_secret_key\":\"SECRET_VALUE\",...},...};`\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability is an information exposure that does not require a nonce to trigger. However, the exposed `formlayer_data` object **contains** a valid nonce for the `formlayer-frontend` action, which can be used to interact with the `formlayer_submit_form` AJAX endpoint.\n\n**To extract the leaked data and the nonce via the security agent:**\n1.  Create a page with the shortcode `[formlayer id=\"1\"]` (or any valid form ID).\n2.  Navigate to the page using `browser_navigate`.\n3.  Execute JavaScript to retrieve the localized object:\n    `browser_eval(\"window.formlayer_data\")`\n4.  The sensitive keys will be located in the `.messages` property of the returned object.\n\n## 5. Exploitation Strategy\n### Step-by-Step Plan:\n1.  **Configuration:** Update the `formlayer_settings` option with a \"canary\" secret key to simulate a configured environment.\n2.  **Target Creation:** Create a `formlayer_form` post and a public page containing the corresponding shortcode.\n3.  **Extraction:** Navigate to the public page as an unauthenticated user.\n4.  **Payload:** Execute `browser_eval(\"window.formlayer_data.messages\")`.\n5.  **Verification:** Parse the JSON output and confirm the presence of the \"canary\" secret key.\n\n## 6. Test Data Setup\nRun these WP-CLI commands to prepare the environment:\n\n```bash\n# 1. Set a sensitive canary value in settings\nwp option update formlayer_settings '{\"captcha_h_secret_key\":\"CVE-2026-59519-CANARY-SECRET\", \"captcha_h_site_key\":\"site-key-123\"}' --format=json\n\n# 2. Create a dummy form (needed for the shortcode to render)\nFORM_ID=$(wp post create --post_type=formlayer_form --post_title=\"Leak Test Form\" --post_status=publish --post_content='{\"fields\":[{\"type\":\"text\",\"label\":\"Name\"}]}' --porcelain)\n\n# 3. Create a public page with the shortcode\nwp post create --post_type=page --post_title=\"Contact Us\" --post_status=publish --post_content=\"[formlayer id=\\\"$FORM_ID\\\"]\"\n```\n\n## 7. Expected Results\n*   The `browser_eval` call to `window.formlayer_data` should return an object.\n*   The `messages` property of that object should contain a key-value pair: `\"captcha_h_secret_key\": \"CVE-2026-59519-CANARY-SECRET\"`.\n*   The `nonce` property should contain a 10-character WordPress nonce.\n\n## 8. Verification Steps\nAfter the exploit attempt, verify the results against the database state:\n```bash\n# Check the value in the database to ensure the leaked data matches\nwp option get formlayer_settings --format=json\n```\nIf the output of `browser_eval` matches the output of `wp option get`, the information exposure is confirmed.\n\n## 9. Alternative Approaches\nIf the `[formlayer]` shortcode does not render or enqueue scripts due to missing form data, try targeting the `render_shortcode` logic in `main\u002Ffrontend.php`. \n*   **Fallback Rendering:** If the form content is not valid JSON, the plugin falls back to `render_form_fallback`. \n*   **Direct Script Check:** Even if the form HTML is broken, if `wp_enqueue_script('formlayer-frontend', ...)` is called, the `formlayer_data` object will be present in the page head or footer. Check the page source for the string `formlayer_data` even if `browser_eval` fails initially.","gemini-3-flash-preview","2026-07-25 09:39:03","2026-07-25 09:39:54",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","1.0.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fformlayer\u002Ftags\u002F1.0.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fformlayer.1.0.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fformlayer\u002Ftags\u002F1.0.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fformlayer.1.0.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fformlayer\u002Ftags"]