EUVD-2026-100986
GHSA-j3m8-hm59-fgm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running JetFormBuilder ≤3.6.6
-
ExploitSend unauthenticated request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactTrigger availability impact on plugin function
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a target WordPress site with the JetFormBuilder plugin installed at a version from n/a through 3.6.6 and reachable over the network. Exploitation depends on the specific plugin endpoint whose access control is missing or 'incorrectly configured' (per the description) being accessible; the vendor vector (PR:N/UI:N) indicates no authentication and no user interaction are needed against affected configurations. Limiting factors: the issue is fixed in versions after 3.6.6, so patched or non-default-hardened sites are not affected, and the precise feature/endpoint required is not disclosed in the provided data, so verify the exact vulnerable action with the Patchstack advisory. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a network-reachable, unauthenticated, low-complexity flaw with availability-only impact and no confidentiality or integrity loss - an unusual profile for a Missing Authorization (CWE-862) / broken access control issue, which typically yields data exposure or unauthorized modification rather than pure availability damage. This C:N/I:N/A:H shape should be verified with the vendor, as it may understate data-access consequences or reflect a specific denial-of-function endpoint. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rests entirely on the theoretical CVSS profile plus the broad install base of the plugin. Net: a legitimate patch-soon issue for WordPress sites running JetFormBuilder, but absent exploitation evidence it is not an emergency relative to confirmed in-the-wild threats. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to a JetFormBuilder endpoint on a WordPress site running version ≤3.6.6 whose access-control checks are missing or misconfigured, invoking a protected action without authorization. Per the CVSS availability impact, this results in denial or disruption of the affected functionality rather than data theft. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Missing authorization in the Crocoblock JetFormBuilder WordPress plugin through version 3.6.6 allows unauthenticated network attackers to reach an improperly access-controlled endpoint, with the assessed impact being availability-only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Per the independent assessment, exploitation requires a site with an affected version where the specific vulnerable plugin action is reachable, and no public exploit was identified at time of analysis. Signals are mixed and point to a moderate, not top-tier, priority.
RemediationAI
Update the JetFormBuilder plugin to a version later than 3.6.6 to obtain the vendor fix; no exact patched version number is provided in the input data, so confirm the latest release. Refer to the Patchstack advisory for the precise fixed version and details about the affected endpoint. If immediate upgrade is not possible, consider disabling the JetFormBuilder plugin until patched, or restrict access to the vulnerable endpoint via a web application firewall once the specific action is identified from the advisory - noting that the exact endpoint is not disclosed here, so virtual patching must be based on vendor guidance. Because the assessed impact is availability-only, ensure you have backups and monitor for unexpected service disruptions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing authorization (CWE-862) issue in JetFormBuilder, a WordPress form builder plugin by Crocoblock. According to the description, access control security levels are incorrectly configured, allowing actions that should be restricted to privileged users to be performed by lower-privileged or unauthenticated parties. The CVSS vector (PR:N, UI:N) indicates the vulnerable endpoint does not require authentication or user interaction, but the impact metrics (C:N/I:N/A:H) assess only a high availability loss, suggesting the exposed action can degrade or deny service rather than alter data or disclose information. The exact plugin endpoint/action is not disclosed in the provided data; consult the Patchstack advisory for specifics. No CPE data was provided; affected component is the WordPress plugin 'jetformbuilder' versions from n/a through 3.6.6.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Patchstack describes an unauthenticated, network, low-complexity missing-authorization flaw (AV:N/AC:L/PR:N/UI:N) with only availability impact reported, hence C:N/I:N/A:H.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
Executive ViewAI
The Crocoblock JetFormBuilder plugin for WordPress - installed on sites through version 3.6.6 - contains a missing-authorization flaw that lets unauthenticated network attackers reach an endpoint they should not be able to access, with the assessed effect being loss of availability rather than data theft or site modification. Any organization running an affected WordPress site could see form submission and related functionality disrupted or taken offline, which matters most for marketing, intake, and customer-facing workflows that depend on those forms. No vendor patch and no public exploit were identified at time of analysis, so the near-term risk is real but not yet demonstrated in the field.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate the JetFormBuilder plugin where operationally feasible; block or rate-limit unauthenticated traffic to the vulnerable plugin action using WAF/virtual patching or reverse-proxy rules; restrict endpoint reachability by IP allowlisting or geo-filtering; monitor site and form availability with alerting on request-volume anomalies; ensure current backups and tested restore procedures to shorten recovery from an availability disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB