CVE-2026-19858: CWE-200 Information Exposure in JetFormBuilder — Dynamic Blocks Form Builder

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.2 contain an authorization bypass vulnerability (CWE-200) that occurs because the plugin does not verify user permissions when processing request-derived data during page rendering. This allows unauthenticated attackers to read sensitive data including user credentials, private content, and metadata secrets. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No official patch or remediation level is currently confirmed, and no known exploits are reported in the wild.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information such as password hashes, private and draft content, and other confidential metadata stored by the plugin. This exposure can compromise user accounts and site confidentiality. There is no impact on data integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if sensitive data exposure risk is unacceptable. Monitor vendor channels for updates and apply patches promptly once available.