{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jetformbuilder--3.6.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crocoblock:jetformbuilder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-119481"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["JetFormBuilder (\u003c= 3.6.7.1)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Crocoblock"],"content_html":"\u003cp\u003eCrocoblock JetFormBuilder is susceptible to a privilege escalation vulnerability (CVE-2026-119481) due to an incorrect privilege assignment flaw. The vulnerability allows unauthenticated attackers to elevate their privileges within a WordPress environment. It affects all versions up to and including 3.6.7.1. A proof-of-concept exploit is publicly available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to achieve high-level privileges, potentially leading to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the JetFormBuilder plugin to a version beyond 3.6.7.1 as soon as a security update is released by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user accounts for anomalous role changes or unauthorized administrative access.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WordPress administrative interface using IP allowlisting or VPNs where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T16:03:36Z","date_published":"2026-11-04T16:03:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-jetformbuilder-privilege-escalation/","summary":"An incorrect privilege assignment vulnerability in the JetFormBuilder WordPress plugin allows unauthenticated attackers to perform privilege escalation.","title":"Crocoblock JetFormBuilder: Privilege escalation (CVE-2026-119481)","url":"https://feed.craftedsignal.io/briefs/2026-11-jetformbuilder-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - JetFormBuilder (\u003c= 3.6.7.1)","version":"https://jsonfeed.org/version/1.1"}