Threat Entry Updated 2026-07-02

CVE-2026-13459 - Jetformbuilder Plugin

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta —…

PLUGIN Jetformbuilder

CVE-2026-13459

MEDIUM CVSS 5.3 2026-07-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-4373 - Jetformbuilder Plugin

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with…

PLUGIN Jetformbuilder

CVE-2026-4373

HIGH CVSS 7.5 2026-03-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-12-16

CVE-2025-11991 - Jetformbuilder Plugin

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

PLUGIN Jetformbuilder

CVE-2025-11991

MEDIUM CVSS 5.3 2025-12-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-08-05

CVE-2024-7291 - Jetformbuilder Plugin

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.

PLUGIN Jetformbuilder

CVE-2024-7291

HIGH CVSS 7.2 2024-08-03

Risk Score

Open Full Technical Breakdown