Jetformbuilder Dynamic Blocks Form Builder
Monthly
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.