CVE-2026-19858 in JetFormBuilder Plugin
Summary
by MITRE • 09/05/2026
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in the JetFormBuilder dynamic blocks form builder for WordPress prior to version 3.6.5.2 represents a critical failure in access control mechanisms, specifically categorized under CWE-862 as Missing Authorization. This flaw arises from an insufficient validation of user privileges during the processing of request-derived data within the plugin's page rendering logic. In secure web application architecture, any operation that retrieves or exposes sensitive system information must verify that the initiating actor possesses the necessary permissions to perform such actions. However, in this specific implementation, the code responsible for resolving dynamic block parameters fails to enforce these checks before returning data associated with WordPress entities such as users, posts, and terms. This architectural oversight effectively bypasses the standard role-based access control layers inherent to the WordPress platform, allowing any client making a request to interact with internal object properties without authentication or authorization verification.
The operational impact of this vulnerability is severe due to the breadth of data exposed through the affected endpoints. Unauthenticated attackers can exploit this flaw to read arbitrary user details and metadata, which includes highly sensitive information such as password hashes stored in the WordPress database. The exposure of these cryptographic hashes facilitates offline brute-force attacks against administrator or privileged accounts, potentially leading to full account compromise. Furthermore, the vulnerability allows for the disclosure of private and draft content that is intended to be hidden from public view until explicitly published by an authorized editor or author. This includes sensitive business information, personal data contained in drafts, and other confidential materials stored within post metadata. Additionally, attackers can extract secrets and configuration details managed by the JetFormBuilder plugin itself, which may include API keys, database credentials, or other tokens used for integrations with third-party services.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, as it enables an attacker to gather information that aids in credential stuffing or password cracking attacks against valid user accounts on the target system. It also relates to T1530, Data from Local System, specifically regarding the exfiltration of sensitive files and database content through web application interfaces rather than direct file system access. The ability to read term metadata further expands the attack surface by potentially revealing taxonomy structures that could aid in mapping out the site's architecture for more targeted exploitation attempts later in an engagement.
Mitigation strategies must prioritize immediate remediation given the severity of data exposure involved. Site administrators should upgrade the JetFormBuilder plugin to version 3.6.5.2 or any subsequent release where this authorization check has been implemented and validated by the developers. Until the patch is applied, temporary mitigations may include restricting access to WordPress admin-ajax.php endpoints if they are directly exposed through custom firewall rules, although this requires careful configuration to avoid breaking legitimate functionality. It is also advisable to audit user roles and permissions within the WordPress dashboard to ensure that only trusted individuals have elevated privileges, thereby reducing the blast radius in case of a successful exploitation attempt. Regular security audits and penetration testing should be conducted on form builder plugins to identify similar authorization flaws before they can be leveraged by malicious actors for data theft or further system compromise.