What is the CVSS score of EUVD-2026-37637?

EUVD-2026-37637 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

JetFormBuilder EUVD-2026-37637

Q: Which versions of JetFormBuilder are affected by EUVD-2026-37637?

Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance.

| CVE-2026-54196 MEDIUM

Incorrect Privilege Assignment (CWE-266)

2026-06-17 Patchstack

WordPress Privilege Escalation Jetformbuilder Wordpress Plugin Jetmonsters

6.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-accessible WordPress plugin requires subscriber authentication (PR:L); AC:H reflects specific exploitation conditions; C:H and I:H reflect potential admin escalation; A:N as privilege escalation has no direct availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:51 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions.

AnalysisAI

Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance. The root cause is incorrect privilege assignment (CWE-266) in the plugin's form processing logic, enabling the lowest authenticated WordPress user role to gain unauthorized administrative or elevated access. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS reflects high confidentiality and integrity impact if the high-complexity exploitation conditions are satisfied.

Technical ContextAI

JetFormBuilder is a drag-and-drop WordPress form builder plugin developed by JetMonsters (Crocoblock), identified by CPE cpe:2.3:a:jetmonsters:jetformbuilder:*:*:*:*:*:*:*:*. The affected scope covers all plugin releases up to and including version 3.6.1. CWE-266 (Incorrect Privilege Assignment) indicates the plugin fails to properly enforce role-based access control during form submission or backend processing - a class of flaw where user-supplied input or request parameters can influence the privilege level assigned to an account without adequate server-side authorization checks. In the WordPress role model, 'Subscriber' is the lowest authenticated tier, making this elevation significant if it reaches Editor or Administrator. The AC:H CVSS metric signals that exploitation is not trivially repeatable and likely requires specific form configurations, parameter manipulation, or plugin-state conditions to trigger.

RemediationAI

Update JetFormBuilder to a version later than 3.6.1. The exact patched release version is not specified in the available input data and must be confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-1-privilege-escalation-vulnerability or the WordPress plugin repository changelog. As an interim compensating control, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register' in WordPress) to prevent unauthenticated parties from creating subscriber accounts used as the exploitation entry point - note this trade-off blocks legitimate self-registration. Additionally, deploying a WordPress firewall or security plugin (e.g., Wordfence, Patchstack plugin) with virtual patching rules for this CVE can provide protection prior to patching. Audit existing subscriber-level accounts for unexpected role changes as a detection measure.