{"id":"CVE-2026-13459","aliases":["EUVD-2026-41263","GHSA-p3vr-rhh6-cj6v"],"status":"published","title":"JetFormBuilder \u003c= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00579,"percentile":0.47972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-07-02T08:33:05Z","modified":"2026-07-02T15:16:57Z","products":[{"vendor":"jetmonsters","product":"jetformbuilder — dynamic blocks form builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c19bd3-32ea-4e28-9cde-1a6653acf6f1?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L118"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L52"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L80"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L140"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L160"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L118"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L52"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L80"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L140"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L160"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3591404%40jetformbuilder\u0026new=3591404%40jetformbuilder\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13459"},{"url":"https://github.com/advisories/GHSA-p3vr-rhh6-cj6v"}],"sources":{"cve":[{"id":"CVE-2026-13459","title":"JetFormBuilder \u003c= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","status":"published","published":"2026-07-02T08:33:05.757Z","modified":"2026-07-02T15:01:30.738Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-41263","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","status":"published","published":"2026-07-02T08:33:05Z","modified":"2026-07-02T15:01:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:17.430912Z"}],"ghsa":[{"id":"GHSA-p3vr-rhh6-cj6v","title":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to...","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","status":"published","published":"2026-07-02T12:30:59Z","modified":"2026-07-02T12:31:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:10.929571Z"}],"nvd":[{"id":"CVE-2026-13459","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","status":"published","published":"2026-07-02T10:16:28.247Z","modified":"2026-07-02T15:16:57.317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:27.199837Z"}]}}