Junglewise Threat Intelligence

CVE-2026-13459: Crocoblock JetFormBuilder authorization bypass in get_from_db generator

CVE-2026-13459 · Severity: medium · CVSS 5.3 · Published 2026-07-02

Executive brief

A vulnerability in the JetFormBuilder WordPress plugin allows unauthorized individuals to access sensitive information stored in the website's database. This includes customer personal data from WooCommerce, such as email addresses, phone numbers, and physical addresses, as well as internal system tokens or credentials. An attacker can exploit this if the site uses specific dynamic form features, potentially leading to significant data privacy breaches.

Technical details

The JetFormBuilder plugin for WordPress (versions up to 3.6.3) contains a missing authorization check (CWE-862) within its REST API endpoints related to the 'get_from_db' generator function. An unauthenticated attacker can exploit this by sending a crafted request to the generator update endpoint, provided they can identify a valid form ID and field name from the site's public frontend. Successful exploitation allows the attacker to query and retrieve all distinct values for any arbitrary 'wp_postmeta' key, potentially exposing WooCommerce customer PII, attachment paths, and third-party API tokens. A patch is available in versions following 3.6.3.

Affected products

  • Crocoblock (JetMonsters) JetFormBuilder — Dynamic Blocks Form Builder Up to and including 3.6.3

Timeline

  • 2026-07-02: advisory: NVD publication date

References

Related threats