CVE-2026-19858
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
| Vendor | unknown |
| Product | jetformbuilder — dynamic blocks form builder |
| Published | Sep 5, 2026 |
| Last Updated | Sep 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jetformbuilder — dynamic blocks form builder
Be the first to know when new high vulnerabilities affecting unknown jetformbuilder — dynamic blocks form builder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / JetFormBuilder — Dynamic Blocks Form Builder
0 < 3.6.5.2
References
Credits
Jakub Herman WPScan