jetmonsters JetFormBuilder Plugin up to 3.6.3 on WordPress Attachments authorization

Summaryinfo

A vulnerability was found in jetmonsters JetFormBuilder Plugin up to 3.6.3 on WordPress. It has been rated as problematic. Impacted is an unknown function of the component Attachments Handler. The manipulation leads to authorization. This vulnerability is traded as CVE-2026-13459. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in jetmonsters JetFormBuilder Plugin up to 3.6.3 on WordPress and classified as problematic. This issue affects an unknown function of the component Attachments Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. The summary by CVE is:

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

The weakness was shared by Niv Kochan. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-13459 since 06/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.6.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• jetmonsters

Name

• JetFormBuilder Plugin

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion