JetFormBuilder EUVD-2026-37637

Exploitation requires the attacker to hold at minimum a WordPress subscriber-level account on the target site, as confirmed by PR:L in the CVSS vector. This means either open user registration must be enabled, or the attacker must otherwise obtain valid subscriber credentials (e.g., via phishing or credential stuffing). The AC:H metric indicates specific conditions beyond mere network access must be met - exact triggering parameters are not described in available data but likely involve particular JetFormBuilder form configuration states or specific request structures. Exploitation is entirely blocked against sites where user registration is disabled and no subscriber accounts exist. The unchanged scope (S:U) means impact is confined to the WordPress application itself.

The CVSS 6.8 Medium score (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a meaningful but conditionally exploitable vulnerability. The network attack vector and absence of user interaction are escalating factors, while high attack complexity and the requirement for a subscriber-level account act as significant dampeners on opportunistic mass exploitation. No EPSS score was provided, preventing quantitative exploitation probability assessment. CVE-2026-54196 does not appear in CISA KEV, and no POC code has been identified, indicating no confirmed active exploitation at time of analysis. Real-world risk is most elevated for WordPress sites with open public user registration, where any internet user could register a subscriber account and attempt exploitation. Sites where user registration is disabled or restricted to vetted accounts face substantially reduced exposure. The S:U (unchanged scope) limits blast radius to the WordPress site itself rather than adjacent systems.

An attacker registers a free subscriber account on a WordPress site with open user registration and JetFormBuilder <= 3.6.1 installed. By submitting a specially crafted form request that satisfies the specific conditions reflected by the AC:H rating - likely involving manipulated role-related form fields or endpoint parameters - the attacker triggers incorrect privilege assignment and elevates their account to an editor or administrator role. With elevated access, the attacker can install malicious plugins, exfiltrate site data, or establish persistent backdoor access.