JetFormBuilder exposes arbitrary WordPress object and metadata properties
JetFormBuilder before 3.6.5.2 resolves unauthenticated request-derived data during page rendering without authorization checks. A visitor can read arbitrary user, post, and term properties or metadata, including password hashes, draft and private content, and secrets stored by other plugins.
- Component
- JetFormBuilder — Dynamic Blocks Form Builder
- Plugin slug
jetformbuilder-dynamic-blocks-form-builder- Affected
- < 3.6.5.2
- Safe version
3.6.5.2- Published
- Sep 05, 2026
This CVE was published Sep 05, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update to JetFormBuilder 3.6.5.2 or later, rotate secrets stored in exposed metadata, force password resets where hashes may have been disclosed, and assess access to draft or private content.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N