Is CVE-2026-123861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123861 being exploited in the wild.

How severe is CVE-2026-123861?

Medium severity, with a CVSS score of 5.3, published 7 November 2026.

Which products and versions are affected?

Crocoblock JetFormBuilder – Hierarchical Select through 1.0.10.

Is there a fix for CVE-2026-123861?

Yes: fixed in 1.0.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123861 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123861?

Check whether you run Crocoblock JetFormBuilder – Hierarchical Select at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123861: CrocoBlock JetFormBuilder Hierarchical Select insecure direct object reference

CVE-2026-123861 · Severity: medium · CVSS 5.3 · Published 2026-11-07

JetFormBuilder – Hierarchical Select is a WordPress plugin that enables form builders to create hierarchical dropdown selections. An insecure direct object reference (IDOR) vulnerability allows unauthenticated attackers to access other users' data by modifying object identifiers in requests. This could lead to unauthorized disclosure of sensitive information submitted through forms.

Vendors: Crocoblock.

Quick answers

Is CVE-2026-123861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123861 being exploited in the wild.
How severe is CVE-2026-123861?: Medium severity, with a CVSS score of 5.3, published 7 November 2026.
Which products and versions are affected?: Crocoblock JetFormBuilder – Hierarchical Select through 1.0.10.
Is there a fix for CVE-2026-123861?: Yes: fixed in 1.0.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123861 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123861?: Check whether you run Crocoblock JetFormBuilder – Hierarchical Select at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.0.11

Technical details

The vulnerability is an IDOR flaw in the JetFormBuilder – Hierarchical Select plugin that fails to properly validate access controls based on user-supplied IDs. An unauthenticated attacker can modify parameters in requests to access objects belonging to other users, bypassing authorization checks. The plugin versions through 1.0.10 are affected; version 1.0.11 contains the fix.

Affected products

CrocoBlock JetFormBuilder – Hierarchical Select through 1.0.10

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.