CVE-2026-19858: JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetFormBuilder — Dynamic Blocks Form Builder WordPress pluginto a version that resolves this vulnerability.Fixed in 3.6.5.2 - Compensating control
Restrict access to any endpoints/pages where JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin renders request-derived data so that unauthenticated users cannot trigger disclosure.
- Operational
Review JetFormBuilder—stored metadata and rotate/reset any exposed secrets or credentials (including any password hashes or private/draft content) after upgrading to 3.6.5.2.
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it. No login or stated privilege level is required to trigger the vulnerable request-derived data resolution during page rendering.
What information could be exposed?
An attacker may read arbitrary user, post, and term properties and metadata. This can include password hashes, private or draft content, and secrets stored in metadata by the plugin.
Which installations are affected?
JetFormBuilder — Dynamic Blocks Form Builder versions before 3.6.5.2 are affected. The provided information does not identify any configuration prerequisite or feature setting that must be enabled.
What should be done if updating cannot happen immediately?
The provided information does not specify a workaround or mitigation. Prioritize restricting exposure of affected pages and sensitive metadata until the plugin can be updated to version 3.6.5.2 or later.