CVE-2026-119481 · Other
NO FIX YET · SEE WHAT TO DO
JetFormBuilder, a WordPress form plugin from Crocoblock, assigns privileges incorrectly, according to the NVD entry. An attacker can gain higher privileges than they should have.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the JetFormBuilder plugin at version 3.6.7.1 or earlier are in the affected range. The sources do not say which configurations or roles are needed to exploit it. Sites without JetFormBuilder installed are not affected.
Not affected if plugin-not-installed
Who cares crocoblock, jetformbuilder, wordpress
3.6.7.13.6.7.1, the last affected version named in the NVD entryIncorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119481") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.