CVE-2026-13459: JetFormBuilder Auth Bypass Vulnerability

CVE-2026-13459 Overview

CVE-2026-13459 is an authorization bypass vulnerability in the JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress. The flaw affects all versions up to and including 3.6.3. The plugin fails to verify that a user is authorized to perform an action on the get-from-db generator endpoint. Unauthenticated attackers can retrieve every distinct value stored under any arbitrary wp_postmeta key on the site. This exposes WooCommerce billing personally identifiable information (PII) such as _billing_email, _billing_phone, and _billing_address, along with order totals, attachment paths, and third-party plugin credentials stored in post meta. The issue is tracked under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can read arbitrary wp_postmeta values across the site, including WooCommerce customer PII and stored API tokens.

Affected Products

JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress, all versions through 3.6.3
WordPress sites publishing at least one JetFormBuilder form containing a get_from_db generator field
WooCommerce deployments using JetFormBuilder for checkout, registration, or profile forms

Discovery Timeline

2026-07-02 - CVE-2026-13459 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13459

Vulnerability Analysis

The vulnerability resides in the JetFormBuilder REST API endpoint that backs the get_from_db generator field. The endpoint is registered in modules/option-field/rest-api/generator-update-endpoint.php and calls into includes/generators/get-from-db.php. The generator is designed to populate a form field with distinct values from a specified wp_postmeta key, but the endpoint does not enforce a capability check on the caller.

Because the caller supplies the target meta key as part of the request, and because the endpoint executes the underlying database query with the site's WordPress database user, an unauthenticated request can enumerate values for any meta key. This includes WooCommerce order meta such as _billing_email, _billing_phone, _billing_first_name, _billing_address_1, and _order_total, plus API tokens or secrets that plugins routinely persist in post meta.

Root Cause

The root cause is missing authorization on the REST route. The permission_callback returns success without validating the caller against a capability such as edit_posts or a form-owner check. The generator input is trusted, so the meta key supplied by the client is used directly in the query that returns distinct meta values.

Attack Vector

Exploitation requires only network access to the target site. An attacker browses the public site to discover a published jet-form-builder post that contains a get_from_db generator field. From the rendered form and page markup, the attacker collects the form ID, field name, and generator ID. The attacker then issues a request to the JetFormBuilder generator REST endpoint, substituting an arbitrary wp_postmeta key such as _billing_email. The endpoint returns the distinct set of values for that meta key across the site.

No authentication, user interaction, or elevated privileges are required. See the Wordfence Vulnerability Report and the JetFormBuilder Changeset for the corrected authorization logic.

Detection Methods for CVE-2026-13459

Indicators of Compromise

Unauthenticated POST or GET requests to JetFormBuilder REST routes under /wp-json/jet-form-builder/ that reference the get_from_db generator or option-field update endpoint.
Requests specifying sensitive wp_postmeta keys in generator parameters, including _billing_email, _billing_phone, _billing_address_1, _order_total, or third-party token keys.
Bursts of requests from a single IP enumerating multiple form IDs, field names, or generator IDs in short succession.

Detection Strategies

Inspect web server access logs for requests to JetFormBuilder REST endpoints with no authentication cookie or nonce header, correlated with 200 responses returning JSON arrays.
Alert on anomalous outbound response sizes from the JetFormBuilder REST route, which can indicate bulk PII extraction.
Deploy a Web Application Firewall (WAF) rule to flag requests whose body contains meta key patterns beginning with _billing_, _shipping_, or _order_.

Monitoring Recommendations

Enable WordPress REST API request logging and forward events to a centralized SIEM for retention and correlation.
Monitor for repeated 4xx-then-200 sequences against the JetFormBuilder route, which suggest attackers probing parameters before a successful extraction.
Track outbound egress from the web tier for unusual data volumes tied to the WordPress PHP process.

How to Mitigate CVE-2026-13459

Immediate Actions Required

Update the JetFormBuilder plugin to a version newer than 3.6.3 that includes the authorization fix committed in changeset 3591404.
Audit published jet-form-builder posts and remove or unpublish any form containing a get_from_db generator field until patching is complete.
Review recent web logs for evidence of exploitation and, if PII exposure is suspected, follow applicable breach notification obligations.

Patch Information

The JetFormBuilder maintainers addressed the missing authorization in the option-field generator REST endpoint. The corrected code adds a capability check before returning meta values. See the WordPress plugin changeset and the affected files in get-from-db.php and generator-update-endpoint.php.

Workarounds

Deploy a WAF rule that blocks unauthenticated requests to /wp-json/jet-form-builder/ routes referencing the get_from_db generator.
Remove get_from_db generator fields from all published JetFormBuilder forms until the plugin is updated.
Restrict WordPress REST API access from anonymous users at the reverse proxy layer where site functionality permits.

bash

# Example NGINX rule to block anonymous access to the vulnerable route
location ~ ^/wp-json/jet-form-builder/.*generator {
    if ($http_cookie !~ "wordpress_logged_in") {
        return 403;
    }
}