JetFormBuilder CVE-2026-28140

No special conditions are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against any WordPress installation with JetFormBuilder ≤ 3.6.4.1 installed and activated. The plugin does not need to be in any specific operational mode or non-default configuration; its mere presence and activation is sufficient. Exploitation is bounded by integrity impact only (I:H, C:N, A:N), meaning an attacker can modify data or trigger unauthorized actions but cannot directly read sensitive data or cause a denial of service via this vector. The specific vulnerable endpoint or AJAX action is not disclosed in publicly available data at time of analysis, which provides minor obscurity-based friction but should not be relied upon as a control.

The CVSS 7.5 score is driven by unauthenticated network access (AV:N/AC:L/PR:N/UI:N) combined with high integrity impact (I:H), which accurately reflects a remotely exploitable, no-credential-required authorization bypass. The absence of confidentiality and availability impact (C:N/A:N) limits the blast radius to write-primitive scenarios - data tampering, form configuration manipulation, or unauthorized action execution. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC reduce immediate urgency compared to a weaponized flaw, but the low exploitation complexity (AC:L, PR:N) means that once a POC surfaces, mass exploitation is straightforward. WordPress plugin vulnerabilities of this class are routinely targeted by automated scanners. Priority should be high for any internet-facing WordPress installation running this plugin.

An unauthenticated attacker discovers a WordPress site running JetFormBuilder ≤ 3.6.4.1 via passive fingerprinting (plugin readme.txt version disclosure or HTTP response headers). The attacker sends a crafted HTTP request - likely a REST API call or AJAX request - to a plugin endpoint that lacks a permission_callback check, triggering a privileged action such as modifying form configurations, altering stored submissions, or executing backend plugin actions without credentials. No public POC has been identified at time of analysis, but the low attack complexity makes exploit development straightforward once the specific endpoint is identified.