CVE-2026-119482: WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilderto a version that resolves this vulnerability.Fixed in 3.6.8
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable and requires no privileges or user interaction. An unauthenticated attacker can target an affected JetFormBuilder installation over the network.
What security impact is indicated?
The provided severity vector indicates an integrity impact of Low, with no indicated confidentiality or availability impact. The issue is classified as broken access control caused by missing authorization or incorrectly configured access-control levels.
Which versions are affected?
JetFormBuilder versions through 3.6.7.1 are affected. The provided data does not identify a fixed version.