{"id":"CVE-2026-19858","title":"The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post…","summary":"The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-200"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19858","references":[{"url":"https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00316,"epssPercentile":0.24762,"ingestedAt":"2026-09-06T03:49:19.589Z","slug":"CVE-2026-19858","body":"## Overview\n\nThe JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8171,"id":"CVE-2026-19858","ts":1788919966136,"field":"cvss","old":null,"new":"7.5"},{"seq":8170,"id":"CVE-2026-19858","ts":1788919966136,"field":"severity","old":"none","new":"high"},{"seq":7980,"id":"CVE-2026-19858","ts":1788919253786,"field":"cvss","old":"7.5","new":null},{"seq":7979,"id":"CVE-2026-19858","ts":1788919253786,"field":"severity","old":"high","new":"none"},{"seq":7789,"id":"CVE-2026-19858","ts":1788916326952,"field":"cvss","old":null,"new":"7.5"},{"seq":7788,"id":"CVE-2026-19858","ts":1788916326952,"field":"severity","old":"none","new":"high"},{"seq":7598,"id":"CVE-2026-19858","ts":1788915271414,"field":"cvss","old":"7.5","new":null},{"seq":7597,"id":"CVE-2026-19858","ts":1788915271414,"field":"severity","old":"high","new":"none"},{"seq":7407,"id":"CVE-2026-19858","ts":1788912686584,"field":"cvss","old":null,"new":"7.5"},{"seq":7406,"id":"CVE-2026-19858","ts":1788912686584,"field":"severity","old":"none","new":"high"},{"seq":7216,"id":"CVE-2026-19858","ts":1788911303742,"field":"cvss","old":"7.5","new":null},{"seq":7215,"id":"CVE-2026-19858","ts":1788911303742,"field":"severity","old":"high","new":"none"},{"seq":7023,"id":"CVE-2026-19858","ts":1788909055461,"field":"cvss","old":null,"new":"7.5"},{"seq":7022,"id":"CVE-2026-19858","ts":1788909055461,"field":"severity","old":"none","new":"high"},{"seq":6835,"id":"CVE-2026-19858","ts":1788907367999,"field":"cvss","old":"7.5","new":null},{"seq":6834,"id":"CVE-2026-19858","ts":1788907367999,"field":"severity","old":"high","new":"none"},{"seq":6641,"id":"CVE-2026-19858","ts":1788905422813,"field":"cvss","old":null,"new":"7.5"},{"seq":6640,"id":"CVE-2026-19858","ts":1788905422813,"field":"severity","old":"none","new":"high"},{"seq":6459,"id":"CVE-2026-19858","ts":1788903436435,"field":"cvss","old":"7.5","new":null},{"seq":6458,"id":"CVE-2026-19858","ts":1788903436435,"field":"severity","old":"high","new":"none"},{"seq":6255,"id":"CVE-2026-19858","ts":1788901791130,"field":"cvss","old":null,"new":"7.5"},{"seq":6254,"id":"CVE-2026-19858","ts":1788901791130,"field":"severity","old":"none","new":"high"},{"seq":6085,"id":"CVE-2026-19858","ts":1788899549144,"field":"cvss","old":"7.5","new":null},{"seq":6084,"id":"CVE-2026-19858","ts":1788899549144,"field":"severity","old":"high","new":"none"},{"seq":6013,"id":"CVE-2026-19858","ts":1788898240433,"field":"cvss","old":null,"new":"7.5"},{"seq":6012,"id":"CVE-2026-19858","ts":1788898240433,"field":"severity","old":"none","new":"high"}]}