Code Injection Vulnerability in JetFormBuilder Plugin by JetMonsters
CVE-2026-32525

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Jetformbuilder
Vendor
CVE Published:
25 March 2026

What is CVE-2026-32525?

The JetFormBuilder plugin by JetMonsters suffers from a code injection vulnerability due to improper control of code generation. This flaw can potentially allow attackers to execute arbitrary code on the server, leading to unauthorized access or manipulation of the affected system. Users of JetFormBuilder versions up to 3.5.6.1 are particularly at risk and should consider applying necessary patches to mitigate this security threat.

Affected Version(s)

JetFormBuilder <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/jetformb...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.