CVE-2026-123861: WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability

Q: Which installations are affected?

The issue affects JetFormBuilder – Hierarchical Select versions through 1.0.10. The available data does not identify a fixed version or specify whether any particular WordPress configuration is required.

Q: What access does an attacker need to exploit this issue?

The vulnerability is described as an authorization bypass through a user-controlled key, consistent with an insecure direct object reference. The available information does not state whether authentication, a specific user role, or any other prerequisite is required.

Q: How can I determine whether my site has been exposed?

Confirm whether JetFormBuilder – Hierarchical Select is installed and running version 1.0.10 or an earlier affected version. The provided data contains no request patterns, logs, indicators of compromise, or affected object types that would allow confirmation of exploitation.

Published Nov 7, 2026

Updated

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CrocoBlock JetFormBuilder – Hierarchical Select to a version that resolves this vulnerability.
Fixed in 1.0.11

Event History

Nov 7, 2026

CVE Published

via MITRE·12:43 PM

Data Sourced

via MITRE·12:43 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects JetFormBuilder – Hierarchical Select versions through 1.0.10. The available data does not identify a fixed version or specify whether any particular WordPress configuration is required.

What access does an attacker need to exploit this issue?

The vulnerability is described as an authorization bypass through a user-controlled key, consistent with an insecure direct object reference. The available information does not state whether authentication, a specific user role, or any other prerequisite is required.

How can I determine whether my site has been exposed?

Confirm whether JetFormBuilder – Hierarchical Select is installed and running version 1.0.10 or an earlier affected version. The provided data contains no request patterns, logs, indicators of compromise, or affected object types that would allow confirmation of exploitation.

CVE-2026-123861: WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site has been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site has been exposed?