Cpe:2.3:a:crocoblock:jetformbuilder:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acrocoblockjetformbuilder/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 16:03:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCrocoblock JetFormBuilder: Privilege escalation (CVE-2026-119481)https://feed.craftedsignal.io/briefs/2026-11-jetformbuilder-privilege-escalation/Wed, 04 Nov 2026 16:03:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-jetformbuilder-privilege-escalation/An incorrect privilege assignment vulnerability in the JetFormBuilder WordPress plugin allows unauthenticated attackers to perform privilege escalation.Crocoblock JetFormBuilder is susceptible to a privilege escalation vulnerability (CVE-2026-119481) due to an incorrect privilege assignment flaw. The vulnerability allows unauthenticated attackers to elevate their privileges within a WordPress environment. It affects all versions up to and including 3.6.7.1. A proof-of-concept exploit is publicly available.

Impact

Successful exploitation allows an unauthenticated attacker to achieve high-level privileges, potentially leading to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impact.

Recommendation

  • Update the JetFormBuilder plugin to a version beyond 3.6.7.1 as soon as a security update is released by the vendor.
  • Audit WordPress user accounts for anomalous role changes or unauthorized administrative access.
  • Restrict access to the WordPress administrative interface using IP allowlisting or VPNs where possible.
]]>criticaladvisorywordpresspluginprivilege-escalationvulnerability