CVE-2026-107431: WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilder pluginto a version that resolves this vulnerability.Fixed in 3.6.6.1
Event History
Frequently Asked Questions
Which JetFormBuilder versions are affected?
JetFormBuilder versions through 3.6.6 are affected. The available information does not identify a fixed version.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected security impact?
The reported impact is denial of service or other availability disruption. The supplied CVSS vector indicates no confidentiality or integrity impact.
Is the issue caused by an access-control configuration concern?
Yes. The issue is described as missing authorization that permits exploitation of incorrectly configured access-control security levels.