JetFormBuilder EUVD-2026-41263

Exploitation requires that the target WordPress site has at least one published post of type jet-form-builder containing a field whose generator_function is configured as get_from_db. This is a non-default feature of the plugin; sites that use JetFormBuilder only for basic forms without database-sourced dynamic fields are not exploitable. Once this condition is met, exploitation is limited only by the attacker's knowledge of a valid form ID, field name, and generator ID - all of which are publicly discoverable by browsing the site's rendered forms and inspecting client-side markup or REST API responses. No authentication is required (PR:N confirmed by CVSS vector). Sites not running JetFormBuilder, or running it without any published get_from_db generator fields, are not affected. The scope of data exposed is bounded by what third-party plugins store in wp_postmeta; sites without WooCommerce or credential-storing plugins face lower practical impact.

The NVD/Wordfence CVSS score of 5.3 (C:L) significantly understates real-world confidentiality impact. The described exfiltration surface includes authentication credentials, API tokens, and WooCommerce PII stored in wp_postmeta - data classes that warrant C:H under CVSS 3.1 methodology, yielding a base score closer to 7.5. CVSS vectors confirm AV:N/AC:L/PR:N/UI:N, meaning this is remotely exploitable by unauthenticated attackers with no user interaction and low attack complexity. The primary limiting factor is a conditional deployment requirement: the site must have at least one published JetFormBuilder form using a get_from_db generator field. This makes exploitation conditional but not difficult - these parameters are self-disclosing via public form browsing. No CISA KEV listing and no confirmed POC exist at time of analysis, and EPSS data was not provided; however, the low attack complexity and unauthenticated access path make this a credible opportunistic target for automated scanning once the condition is known. Sites running WooCommerce alongside JetFormBuilder face the highest practical risk due to stored billing PII and payment-adjacent data in post meta.

An attacker targeting a WooCommerce store browses the site, identifies a published JetFormBuilder form, and enumerates the form's generator configuration by inspecting page source or making REST API discovery requests to obtain the form ID, field name, and generator ID. The attacker then sends a crafted unauthenticated POST or GET request to the JetFormBuilder generator REST endpoint supplying those parameters with an arbitrary wp_postmeta key (e.g., _billing_email), and the server returns all distinct values stored under that key across all posts - leaking customer email addresses, billing details, or third-party API tokens in a single request. No public exploit code is known at time of analysis, but the attack requires only standard HTTP tooling.