Skip to content
Sign in
7.5 High

CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks…

Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.

Affected products and versions

Product Affected versions Fixed in
JetFormBuilder — Dynamic Blocks Form Builder 3.6 earliest → < 3.6.5.2 3.6.5.2

Other CVEs of JetFormBuilder — Dynamic Blocks Form Builder

The 3 CVEs of JetFormBuilder — Dynamic Blocks Form Builder →
CVE-2026-19860 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which… 5.5 Medium CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a… 4.7 Medium
Track this CVE