CVE-2024-7291
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.
| CWE | CWE-269 |
| Vendor | jetmonsters |
| Product | jetformbuilder — dynamic blocks form builder |
| Published | Aug 3, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for jetmonsters jetformbuilder — dynamic blocks form builder
Be the first to know when new high vulnerabilities affecting jetmonsters jetformbuilder — dynamic blocks form builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
jetmonsters / JetFormBuilder — Dynamic Blocks Form Builder
0 ≤ 3.3.4.1
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23
Credits
István Márton