What is the CVSS score of CVE-2026-13459?

CVE-2026-13459 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.6%.

JetFormBuilder CVE-2026-13459

EUVD-2026-41263 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Wordfence

GHSA-p3vr-rhh6-cj6v

WordPress Authentication Bypass Jetformbuilder Dynamic Blocks Form Builder Wordpress Plugin Jetmonsters

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

7.5 HIGH

Network-exploitable with no auth or complexity; confidentiality upgraded to H because exposed data includes credentials, tokens, and PII stored in wp_postmeta.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:21 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site - including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta - provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

AnalysisAI

Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.

Technical ContextAI

JetFormBuilder (CPE: cpe:2.3:a:jetmonsters:jetformbuilder_-_dynamic_blocks_form_builder:*:*:*:*:*:*:*:*) is a Gutenberg-native WordPress form builder plugin by JetMonsters. The vulnerability resides in the plugin's REST API layer: specifically in modules/option-field/rest-api/generator-update-endpoint.php (lines 52, 80, 140) and includes/generators/get-from-db.php (lines 118, 160). The get_from_db generator function is designed to populate dynamic form field options from the WordPress database (wp_postmeta table), but the REST endpoint that invokes it fails to perform any authorization check before executing the query and returning results (CWE-862: Missing Authorization). Because WordPress's wp_postmeta table stores structured metadata for all post types - including WooCommerce orders (_billing_email, _billing_phone, _billing_address, order totals), uploaded attachment paths, and any credentials or API tokens stored by third-party plugins - the absence of an access check exposes the entire key-value space to any unauthenticated caller who can supply valid generator parameters.

RemediationAI

The primary remediation is to update JetFormBuilder to the version released after changeset 3591404; as of this analysis, the exact patched version number is not independently confirmed - administrators should check the WordPress plugin repository for a version newer than 3.6.3 and apply the latest available update. If an immediate update is not possible, the most effective compensating control is to unpublish or convert any JetFormBuilder forms that use a get_from_db generator field, which eliminates the exploitation precondition entirely; note this may break dynamic field population for those forms. Alternatively, a Web Application Firewall rule blocking REST API requests to the JetFormBuilder generator endpoint (typically /wp-json/jet-form-builder/v1/generator or equivalent) for unauthenticated callers will reduce exposure without disrupting the forms themselves, though this may affect legitimate frontend behavior. Sites running WooCommerce should audit their wp_postmeta keys for sensitive third-party credentials and rotate any tokens stored there as a precaution, regardless of whether exploitation is confirmed.