JetFormBuilder Unauthenticated Sensitive Information Disclosure via Missing Authorization (CVE-2026-13459)

Vulnerability Overview Vulnerability Name: JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CVE ID: CVE-2026-13459 CVSS Score: 5.3 (Medium) Publication Date: July 1, 2026 Last Updated: July 2, 2026 Researchers: Ny Kochan Affected Software Affected Software: JetFormBuilder – Dynamic Blocks Form Builder Software Type: Plugin Software Slug: jetformbuilder (view on wordpress.org) Patched: Yes Fixed Version: 3.6.3.1 or later Affected Versions: <= 3.6.3 Remediation Recommendation: Upgrade to version 3.6.3.1 or a later patched version. Vulnerability Description The JetFormBuilder – Dynamic Blocks Form Builder plugin, in versions 3.6.3 and below, contains an authorization bypass vulnerability. This vulnerability allows an unauthenticated attacker to retrieve every distinct value stored under arbitrary wp_postmeta keys, including WooCommerce billing PII (such as _billing_email, _billing_phone, and _billing_address_fields), order totals, attachment paths, and third-party plugin credentials or tokens stored in post meta. Exploitation requires at least one published JetFormBuilder post on the target site containing a field with its generator_function set to get_from_db, and the attacker must provide a matching form ID, field name, and generator ID. References plugins.trac.wordpress.org (multiple links) Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities: The page lists other recent vulnerabilities for JetFormBuilder, including CVE IDs, CVSS scores, researchers, and dates. Disclaimer This record contains copyrighted material, owned by Defiant Inc. and The MITRE Corporation. Contact For errors or to add information, contact support@wordfence.com. Business Hours Weekdays: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X, Facebook, LinkedIn, Instagram Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe Subscribe to news and updates by entering your email address and agreeing to the terms of service and privacy policy. Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other The bottom of the page features the Wordfence Intelligence logo and link.

Goal Reached Thanks to every supporter — we hit 100%!

JetFormBuilder Unauthenticated Sensitive Information Disclosure via Missing Authorization (CVE-2026-13459)