CVE-2026-13459: CWE-862 Missing Authorization in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.
AI Analysis
Technical Summary
CVE-2026-13459 is an authorization bypass vulnerability (CWE-862) in the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin affecting all versions up to and including 3.6.3. The plugin fails to properly verify user authorization before allowing access to data retrieval actions. This enables unauthenticated attackers to access distinct values stored under arbitrary wp_postmeta keys, including sensitive WooCommerce billing information and third-party plugin credentials, provided the site has at least one published JetFormBuilder form with a get_from_db generator field. Attackers can discover necessary form IDs and field names by browsing public forms. No official patch or remediation guidance is currently documented.
Potential Impact
An attacker without authentication can bypass authorization controls to retrieve sensitive information stored in the WordPress post meta table. This includes personally identifiable information related to WooCommerce billing such as email, phone, and address, order totals, attachment paths, and credentials or tokens from third-party plugins. This exposure can lead to privacy violations and potential further compromise depending on the data accessed. The vulnerability does not impact integrity or availability directly but compromises confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling or restricting access to JetFormBuilder forms that use the get_from_db generator field. Monitoring public forms for exposure of form IDs and field names may help reduce risk. Avoid publishing forms with get_from_db generator fields if possible. Follow vendor updates closely for an official patch or mitigation.
CVE-2026-13459: CWE-862 Missing Authorization in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13459 is an authorization bypass vulnerability (CWE-862) in the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin affecting all versions up to and including 3.6.3. The plugin fails to properly verify user authorization before allowing access to data retrieval actions. This enables unauthenticated attackers to access distinct values stored under arbitrary wp_postmeta keys, including sensitive WooCommerce billing information and third-party plugin credentials, provided the site has at least one published JetFormBuilder form with a get_from_db generator field. Attackers can discover necessary form IDs and field names by browsing public forms. No official patch or remediation guidance is currently documented.
Potential Impact
An attacker without authentication can bypass authorization controls to retrieve sensitive information stored in the WordPress post meta table. This includes personally identifiable information related to WooCommerce billing such as email, phone, and address, order totals, attachment paths, and credentials or tokens from third-party plugins. This exposure can lead to privacy violations and potential further compromise depending on the data accessed. The vulnerability does not impact integrity or availability directly but compromises confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling or restricting access to JetFormBuilder forms that use the get_from_db generator field. Monitoring public forms for exposure of form IDs and field names may help reduce risk. Avoid publishing forms with get_from_db generator fields if possible. Follow vendor updates closely for an official patch or mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-26T19:37:59.929Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4634ab27e9c79719a6e30b
Added to database: 07/02/2026, 09:51:39 UTC
Last enriched: 07/02/2026, 10:07:31 UTC
Last updated: 07/03/2026, 00:04:38 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.