CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

CVE-2026-19858

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin, in versions prior to 3.6.5.2 , is vulnerable to an information disclosure flaw. The root cause is a failure to perform authorisation checks when resolving request-derived data during page rendering. This allows unauthenticated use...

CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...