CVE-2026-19858: JetFormBuilder WordPress Plugin Disclosure

CVE-2026-19858 Overview

CVE-2026-19858 is an information disclosure vulnerability in the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin. Versions before 3.6.5.2 fail to perform authorization checks when resolving request-derived data during page rendering. Unauthenticated attackers can read arbitrary user, post, and term properties and metadata.

Exposed data includes password hashes, private and draft content, and secrets stored in metadata by the plugin. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can extract WordPress password hashes and private content from any site running a vulnerable JetFormBuilder installation over the network.

Affected Products

JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions before 3.6.5.2
WordPress sites using JetFormBuilder for form rendering
Any site storing sensitive data in user, post, or term metadata processed by the plugin

Discovery Timeline

2026-09-05 - CVE-2026-19858 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-19858

Vulnerability Analysis

JetFormBuilder resolves request-derived data during page rendering to populate dynamic form fields. This resolver accepts references to user, post, and term objects along with their properties and metadata. The plugin fails to check whether the requesting user is authorized to view the referenced data.

An unauthenticated attacker can craft a request that instructs the resolver to return arbitrary object properties. The response reflects sensitive values back to the attacker through the rendered page. Because the resolver operates before access control checks, private posts, drafts, and hidden metadata are all reachable.

Affected data includes WordPress user records containing user_pass password hashes, user_email addresses, and user_activation_key values. Post metadata and term metadata often contain API keys, integration secrets, and internal notes that were never intended for public exposure.

Root Cause

The root cause is missing authorization enforcement (broken access control) in the request-derived data resolver. The plugin trusts the client-supplied reference and returns the resolved value without validating that the current session has permission to read the underlying object.

Attack Vector

Exploitation requires only network access to a page that renders a JetFormBuilder form. The attacker submits a crafted request identifying the target user, post, or term and the desired property. No authentication, user interaction, or elevated privileges are needed.

The vulnerability is described in the WPScan Vulnerability Report. Refer to the advisory for full technical details of the resolver behavior.

Detection Methods for CVE-2026-19858

Indicators of Compromise

Web server access logs showing repeated POST or GET requests to pages containing JetFormBuilder forms with unusual query parameters referencing user_pass, user_email, or metadata keys
Responses containing hash-like strings (for example $P$B or $wp$2y$ prefixes) returned from public-facing form pages
High volumes of form-related requests from a single source enumerating sequential user or post IDs
Unexpected outbound references to private or draft post slugs in web traffic

Detection Strategies

Inventory all WordPress installations and confirm the JetFormBuilder plugin version is 3.6.5.2 or later
Deploy web application firewall rules that inspect JetFormBuilder request payloads for references to sensitive object properties such as user_pass or _wp_* meta keys
Correlate WordPress access logs with response body scanning to identify pages leaking hash patterns or private content

Monitoring Recommendations

Alert on unauthenticated requests to JetFormBuilder endpoints that reference user or metadata fields
Monitor for enumeration patterns targeting incremental user_id or post_id values
Review outbound content from WordPress sites for leaked credentials that may indicate prior exploitation

How to Mitigate CVE-2026-19858

Immediate Actions Required

Update JetFormBuilder — Dynamic Blocks Form Builder to version 3.6.5.2 or later on all WordPress installations
Force a password reset for all WordPress users if the plugin was exposed to the internet before patching
Rotate any API keys, tokens, or secrets stored in post or user metadata that the plugin could resolve
Audit WordPress access logs for exploitation attempts predating the patch

Patch Information

The vendor addressed the missing authorization checks in JetFormBuilder version 3.6.5.2. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. Confirm the version after upgrade using the Plugins screen or WP-CLI.

Workarounds

Disable and remove the JetFormBuilder plugin until patching is possible if forms are not business-critical
Restrict access to pages containing JetFormBuilder forms through authentication or IP allow-listing at the reverse proxy or web application firewall
Remove sensitive values from post, user, and term metadata that could be resolved by the plugin

bash

# Verify and update JetFormBuilder via WP-CLI
wp plugin get jetformbuilder --field=version
wp plugin update jetformbuilder --version=3.6.5.2
wp plugin get jetformbuilder --field=version