EUVD-2026-71846
GHSA-j6jp-8fp4-2rqv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible page rendering requires no auth or interaction; C:H reflects password hash and private content disclosure; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
AnalysisAI
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have JetFormBuilder - Dynamic Blocks Form Builder installed, active, and at a version below 3.6.5.2, with at least one publicly accessible page containing a JetFormBuilder form block. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) is well-calibrated: exploitation requires no authentication or user interaction, and the confidentiality impact is high because the leaked data includes password hashes suitable for offline cracking. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update JetFormBuilder - Dynamic Blocks Form Builder to version 3.6.5.2 or later immediately; this is a vendor-released patch confirmed by the WPScan advisory (https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify those running JetFormBuilder versions prior to 3.6.5.2 and prepare for immediate patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows u
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attack
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthentic
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today