The vulnerability CVE-2026-32525 in jetmonsters JetFormBuilder (versions up to 3.5.6.1) is an improper control of code generation, classified as a code injection flaw. It allows an attacker with low privileges to inject and execute arbitrary code remotely without user interaction. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system, leading to full compromise of the application and potentially the underlying server. This impacts confidentiality, integrity, and availability of the affected environment. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected JetFormBuilder plugin and monitor for suspicious activity. Avoid using affected versions (up to 3.5.6.1) in production environments if possible.