JetFormBuilder CVE-2026-119482

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required: a remote attacker can reach the vulnerable code against a WordPress site running JetFormBuilder from unspecified versions through 3.6.7.1. The limiting factors are that the site must have the JetFormBuilder plugin installed and running a vulnerable version, and the description ties the flaw to 'Incorrectly Configured Access Control Security Levels', implying the specific vulnerable action/endpoint must be reachable; the exact feature, form configuration, or action required to trigger it is not described in the available sources. Impact is limited to a low integrity effect only (C:N/A:N).

This is a medium-severity (CVSS 5.3) broken access control / missing authorization flaw whose signals are consistent and point to a real-but-limited risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N is network-exploitable, low-complexity and unauthenticated (PR:N), but the impact is confined to integrity only at a low level (C:N/I:L/A:N) - meaning an attacker can likely perform an unauthorized state-changing action rather than read sensitive data or cause downtime. No EPSS score, CISA KEV listing, or confirmed public exploit was provided, so there is no evidence of active or widespread exploitation; this is not a confirmed-exploited emergency. The vuln.today decision label is 'this_month', which aligns with a patch-this-cycle priority rather than immediate incident response. The one caveat is that the CVSS integrity-only, no-confidentiality profile is somewhat generic for a Patchstack-assessed access-control bug - the exact unauthorized action is not described in the available sources, so defenders should treat the precise impact as unverified. Overall: a legitimate but non-urgent fix, elevated chiefly by the plugin's popularity and the unauthenticated network vector, not by any exploitation signal.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running a vulnerable JetFormBuilder version, invoking a plugin action that fails to verify the caller's authorization. Because the specific unauthorized operation is not described in the available sources, the concrete effect is unverified, but the CVSS profile (I:L, C:N, A:N) indicates a limited unauthorized state change rather than data disclosure. No public exploit was identified at time of analysis.