CVE-2026-19858

JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 fails to perform authorisation checks when resolving request-derived data during page rendering. This allows unauthenticated users to read arbitrary user, post, and term properties and metadata, including password hashes...