CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
Unauthenticated attackers can read arbitrary user metadata, including password hashes and private content, via a missing authorization check in the JetFormBuilder plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19858?
CVE-2026-19858 is a high-severity vulnerability in Unknown JetFormBuilder — Dynamic Blocks Form Builder, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Weakness: CWE-200
Which versions are affected by CVE-2026-19858?
How do I fix CVE-2026-19858?
No fix has been published for CVE-2026-19858 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19858 being exploited?
There is no known exploitation of CVE-2026-19858 in the wild and no public exploit code.
Sources
Also known as GHSA-j6jp-8fp4-2rqv.