{"id":"CVE-2026-119481","kind":"vulnerability","aliases":["CVE-2026-119481"],"related":[],"title":"JetFormBuilder: incorrect privilege assignment lets users escalate privileges","description":"Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, assigns privileges incorrectly, according to the NVD entry. An attacker can gain higher privileges than they should have.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list\n- Compare it against the affected range through `3.6.7.1`","fix":"- Move JetFormBuilder past `3.6.7.1`, the last affected version named in the NVD entry","status":"open","published_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:27:51+00:00","updated_at":"2026-11-04T13:27:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-04T13:27:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move JetFormBuilder past `3.6.7.1`, the last affected version named in the NVD entry","reach":"internet","title":"JetFormBuilder: incorrect privilege assignment lets users escalate privileges","impact":"high","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, assigns privileges incorrectly, according to the NVD entry. An attacker can gain higher privileges than they should have.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the affected site","analyst_note":"Check the NVD entry and the Crocoblock or WordPress plugin advisory for the fixed version, required role, and whether a patch exists.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list\n- Compare it against the affected range through `3.6.7.1`\n- unknown for anything else","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetFormBuilder plugin at version 3.6.7.1 or earlier are in the affected range. The sources do not say which configurations or roles are needed to exploit it. Sites without JetFormBuilder installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000683,"input_tokens":4114,"output_tokens":544,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119481':11A,14A '-2026':10A,13A '3.6.7.1':57C 'accord':29B 'affect':52C 'allow':48C 'assign':4A,26B,42C 'attack':35B 'crocoblock':15B,25B,45C 'cve':9A,12A 'entri':33B 'escal':7A 'escalation.this':50C 'form':22B 'gain':37B 'higher':38B 'incorrect':2A,28B,40C 'issu':51C 'jetformbuild':1A,16B,19B,46C,47C,53C 'let':5A 'n/a':55C 'nvd':32B 'plugin':23B 'privileg':3A,8A,27B,39B,41C,49C 'user':6A 'vulner':43C 'wordpress':18B,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetFormBuilder plugin at version 3.6.7.1 or earlier are in the affected range. The sources do not say which configurations or roles are needed to exploit it. Sites without JetFormBuilder installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","crocoblock","jetformbuilder","other","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119481","severity":null,"published_at":"2026-11-04T13:17:26+00:00","modified_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}