EUVD-2026-15889Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitInject malicious code into form field
-
ExecutionExecute arbitrary PHP code
-
ImpactCompromise website and data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated user access to JetFormBuilder plugin (versions <= 3.5.6.1) in WordPress. Attacker with editor or administrator role can inject arbitrary code through form builder interface without victim interaction needed. |
| Impact | This vulnerability presents critical real-world risk despite the absence of a formal CVSS score and EPSS metric in the available intelligence. The RCE capability—confirmed by multiple sources (Patchstack, EUVD database, CVE tags)—is an inherently severe technical impact. Code injection vulnerabilities in WordPress plugins are frequently exploited in the wild due to WordPress's widespread deployment and the plugin ecosystem's variable security maturity. The attack vector is likely network-based and may require low or no privileges (depending on form exposure), making exploitation accessible to unauthenticated attackers. The fact that this affects all versions through 3.5.6.1 with no mention of a patch date raises concern about patch availability and lag time for users. Without published EPSS or CVSS data, practitioners should treat this as a maximum-priority vulnerability requiring immediate patching; WordPress RCE vulnerabilities are routinely automated and scanned for across internet-facing infrastructure within hours of disclosure. |
| Exploit ScenarioDerived | An attacker discovers a WordPress site running JetFormBuilder version 3.5.6.0 and identifies a publicly exposed contact form or dynamic form field. The attacker crafts a malicious form submission containing embedded PHP code (e.g., system commands or webshell code) in a form field that is processed without proper sanitization. When the form is submitted, the injected code is executed by the server, allowing the attacker to read files, modify website content, create administrative accounts, or pivot to other systems on the internal network. Given that forms are typically intended for public submission, this attack requires no authentication or special privileges and can be automated to target multiple WordPress installations simultaneously. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attackers to inject and execute arbitrary code within the application context. The vulnerability affects the JetFormBuilder plugin for WordPress across all versions through 3.5.6.1, and an attacker can leverage this to achieve Remote Code Execution (RCE) by injecting malicious code through form-processing mechanisms. Patchstack has documented this vulnerability with an assigned EUVD ID (EUVD-2026-15889), and while a CVSS score has not been formally assigned, the RCE classification indicates critical severity.
RemediationAI
Immediately upgrade JetFormBuilder to a version later than 3.5.6.1 as soon as the patched version becomes available from JetMonsters. Check the official WordPress plugin repository and the vendor's website for the latest stable release, and apply the update through the WordPress plugin management interface or via direct deployment if using a staging/deployment pipeline. Until a patch is released or applied, implement the following compensating controls: restrict form submission endpoints to whitelisted IP ranges if form functionality is not required for public users, disable the JetFormBuilder plugin if it is not actively in use, implement a Web Application Firewall (WAF) rule to block requests containing suspicious code injection payloads (PHP tags, eval, system calls) targeting form endpoints, and enable detailed logging and monitoring of form submissions for signs of exploitation. Regularly monitor the Patchstack database (https://patchstack.com/database/Wordpress/Plugin/jetformbuilder/) and JetMonsters official channels for patch availability notifications.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetFormBuilder (CPE: cpe:2.3:a:jetmonsters:jetformbuilder:*:*:*:*:*:*:*:*) is a WordPress plugin developed by JetMonsters that provides form-building and form-handling capabilities. The vulnerability stems from improper control of code generation, classified under CWE-94 (Improper Control of Generation of Code), which occurs when user-controlled input is passed to code execution functions without sufficient sanitization or validation. In the context of a form builder, this typically means that form field values, configuration parameters, or dynamically constructed form logic are being evaluated or executed as code, allowing attackers to break out of the intended form processing logic and inject arbitrary PHP or JavaScript code that executes with the privileges of the web server or application context.
Know when Jetformbuilder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.
Executive ViewAI
CVE-2026-32525 presents critical security risk, a code injection vulnerability rated CVSS 9.9. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in JetFormBuilder and Nelio AB Testing Code Injection
View all 2More in Jetformbuilder
View allPrivilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to e
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attacker
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlie
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions
Cross-site scripting (CWE-80, basic XSS) in Crocoblock JetFormBuilder through 3.6.7.1 allows a remote attacker to inject
Missing authorization in Crocoblock JetFormBuilder through 3.6.7.1 allows remote unauthenticated attackers to perform a
GitHub PoC
Exploit-DB