CVE-2026-19858

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.2

Description Insufficient authorization checks during page rendering when resolving request-derived data allow unauthenticated users to read arbitrary user, post, and term properties and metadata. This sensitive information exposure can include password hashes, private and draft content, and other secrets stored in metadata.

Recommendations Update JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin to version 3.6.5.2 or later.