Executive brief
JetFormBuilder is a WordPress plugin that enables users to build dynamic forms. The plugin fails to validate user permissions when processing form requests during page rendering, allowing unauthenticated attackers to retrieve sensitive data including user password hashes, private posts, draft content, and secrets stored by other plugins—compromising user accounts and exposing confidential information.
Technical details
This is an authorization bypass vulnerability (CWE-200: Exposure of Sensitive Information) in the request resolution logic of JetFormBuilder. The plugin does not perform proper permission checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post, and term properties and their associated metadata. The attack vector is network-based and requires no authentication or user interaction; an attacker can craft requests to access password hashes, private/draft content, and plugin metadata. The vulnerability has been patched in version 3.6.5.2.
Affected products
- Crocoblock JetFormBuilder before 3.6.5.2
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 3.6.5.2