What is the CVSS score of EUVD-2026-53943?

EUVD-2026-53943 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of JetFormBuilder are affected by EUVD-2026-53943?

JetFormBuilder WordPress plugin (v3.6.4.1 and earlier) is vulnerable to unauthenticated remote attackers who can modify form data and settings without authorization, affecting any organization using…

How to fix or mitigate EUVD-2026-53943?

Within 24 hours, inventory all WordPress installations using JetFormBuilder v3.6.4.1 or earlier and disable or uninstall the plugin immediately if a functional alternative is available. Within 7 days, evaluate replacement form plugins with active security maintenance (such as WPForms, Gravity Forms, or Formidable Forms) and establish a migration plan for existing forms. Within 30 days, complete migration to a patched or alternative solution; if continued use is unavoidable pending migration, implement compensating controls including Web Application Firewall rules to restrict access to form endpoints, enable WordPress audit logging for form modifications, and conduct weekly configuration integrity reviews.

JetFormBuilder EUVD-2026-53943

| CVE-2026-28140 HIGH

Missing Authorization (CWE-862)

2026-08-06 Patchstack

GHSA-6m3c-4457-37qm

WordPress Authentication Bypass Jetformbuilder Wordpress Plugin Jetmonsters

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

AV:N and PR:N confirmed by unauthenticated remote exploitation; I:H reflects unauthorized write capability; C:N and A:N per bounded impact scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:20 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

AnalysisAI

Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

JetFormBuilder is a WordPress form-building plugin developed by JetMonsters, used for creating complex forms with conditional logic, payments, and custom actions. CWE-862 (Missing Authorization) indicates the plugin exposes one or more REST API endpoints or AJAX actions that execute privileged operations without verifying whether the requesting party holds the necessary capability. WordPress plugins commonly register REST routes or wp_ajax hooks without attaching proper permission_callback checks, which is the canonical root cause of this vulnerability class. The CPE cpe:2.3:a:jetmonsters:jetformbuilder:*:*:*:*:*:*:*:* confirms all versions through 3.6.4.1 are affected. The CVSS impact metrics C:N/I:H/A:N indicate the unauthorized action modifies data or configuration rather than disclosing secrets or disrupting availability.

RemediationAI

Update JetFormBuilder to a version beyond 3.6.4.1 via the WordPress admin plugin dashboard or wp-cli. The exact patched release version is not independently confirmed from available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-4-1-broken-access-control-vulnerability and the official WordPress plugin repository changelog to identify the first fixed version before deploying. As a compensating control prior to patching, consider deploying a Web Application Firewall (WAF) rule to block unauthenticated requests to JetFormBuilder's REST API endpoints (typically prefixed /wp-json/jet-form-builder/) and to wp-admin/admin-ajax.php actions registered by the plugin; note this may break legitimate unauthenticated form submissions and should be tested in staging. Disabling the plugin entirely eliminates the attack surface with the trade-off of losing all form functionality.