CVE-2026-19858 | BDVDB-2026-368477 Detail

Description#

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-05Record published in the CVE List.
2. Version 22026-09-06Most recent update recorded in the CVE List.