Is CVE-2026-13459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13459 being exploited in the wild.

How severe is CVE-2026-13459?

Medium severity, with a CVSS score of 5.3, published 2 July 2026.

Which products and versions are affected?

Crocoblock JetFormBuilder Up to and including 3.6.3.

Is there a fix for CVE-2026-13459?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13459 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13459?

Check whether you run Crocoblock JetFormBuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13459: Crocoblock JetFormBuilder authorization bypass in get_from_db generator

CVE-2026-13459 · Severity: medium · CVSS 5.3 · Published 2026-07-02

A vulnerability in the JetFormBuilder WordPress plugin allows unauthorized individuals to access sensitive information stored in the website's database. This includes customer personal data from WooCommerce, such as email addresses, phone numbers, and physical addresses, as well as internal system tokens or credentials. An attacker can exploit this if the site uses specific dynamic form features, potentially leading to significant data privacy breaches.

Technologies: Crocoblock JetFormBuilder. Vendors: Crocoblock.

Quick answers

Is CVE-2026-13459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13459 being exploited in the wild.
How severe is CVE-2026-13459?: Medium severity, with a CVSS score of 5.3, published 2 July 2026.
Which products and versions are affected?: Crocoblock JetFormBuilder Up to and including 3.6.3.
Is there a fix for CVE-2026-13459?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13459 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13459?: Check whether you run Crocoblock JetFormBuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The JetFormBuilder plugin for WordPress (versions up to 3.6.3) contains a missing authorization check (CWE-862) within its REST API endpoints related to the 'get_from_db' generator function. An unauthenticated attacker can exploit this by sending a crafted request to the generator update endpoint, provided they can identify a valid form ID and field name from the site's public frontend. Successful exploitation allows the attacker to query and retrieve all distinct values for any arbitrary 'wp_postmeta' key, potentially exposing WooCommerce customer PII, attachment paths, and third-party API tokens. A patch is available in versions following 3.6.3.

Affected products

Crocoblock (JetMonsters) JetFormBuilder — Dynamic Blocks Form Builder Up to and including 3.6.3

Timeline

2026-07-02: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.