{"id":"CVE-2026-123861","kind":"vulnerability","aliases":["CVE-2026-123861"],"related":[],"title":"JetFormBuilder Hierarchical Select: authorization bypass through user-controlled key","description":"Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.","summary":"JetFormBuilder Hierarchical Select, a WordPress plugin by CrocoBlock, lets a user control a key that is used for access checks. The sources say an attacker can exploit incorrectly configured access control to get around authorization.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetformbuilder","package","self-hosted","wordpress"],"not_affected_if":[],"how_to_check":"- Check whether the WordPress site runs the `jet-form-builder-hierarchical-select` plugin and read its installed version.","fix":"- Versions up to and including `1.0.10` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:26+00:00","updated_at":"2026-11-07T13:49:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:26Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `1.0.10` are affected; the sources do not name a fixed version.","reach":"internet","title":"JetFormBuilder Hierarchical Select: authorization bypass through user-controlled key","impact":"medium","summary":"JetFormBuilder Hierarchical Select, a WordPress plugin by CrocoBlock, lets a user control a key that is used for access checks. The sources say an attacker can exploit incorrectly configured access control to get around authorization.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetformbuilder","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses access checks and reaches restricted form data","analyst_note":"Check the NVD entry and the CrocoBlock/Wordfence advisory for the affected access control conditions, required privileges, and a fixed version.","how_to_check":"- Check whether the WordPress site runs the `jet-form-builder-hierarchical-select` plugin and read its installed version.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the JetFormBuilder Hierarchical Select WordPress plugin at version 1.0.10 or earlier are in the affected range. The sources do not say which configurations or roles are needed to reach the bypass, so who can skip it is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4261,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123861':13A,16A '-2026':12A,15A '1.0.10':93C 'access':41B,52B,81C 'affect':86C 'allow':77C 'around':56B 'attack':47B 'author':4A,57B,58C 'builder':74C 'bypass':5A,59C 'check':42B 'configur':51B,80C 'control':9A,34B,53B,63C,82C 'crocoblock':30B,67C 'cve':11A,14A 'exploit':49B,78C 'form':73C 'get':55B 'hierarch':2A,24B,69C,75C,88C 'host':21B 'incorrect':50B,79C 'issu':85C 'jet':72C 'jet-form-builder-hierarchical-select':71C 'jetformbuild':1A,17B,23B,68C,87C 'key':10A,36B,64C 'let':31B 'levels.this':84C 'n/a':91C 'packag':18B 'plugin':28B 'say':45B 'secur':83C 'select':3A,25B,70C,76C,89C 'self':20B 'self-host':19B 'sourc':44B 'use':39B 'user':8A,33B,62C 'user-control':7A,61C 'vulner':65C 'wordpress':22B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetFormBuilder Hierarchical Select WordPress plugin at version 1.0.10 or earlier are in the affected range. The sources do not say which configurations or roles are needed to reach the bypass, so who can skip it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetformbuilder","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123861':13A,16A '-2026':12A,15A 'author':4A 'bypass':5A 'control':9A 'cve':11A,14A 'hierarch':2A 'jetformbuild':1A 'key':10A 'select':3A 'user':8A 'user-control':7A","search_b":"'access':41B,52B 'around':56B 'attack':47B 'author':57B 'check':42B 'configur':51B 'control':34B,53B 'crocoblock':30B 'exploit':49B 'get':55B 'hierarch':24B 'host':21B 'incorrect':50B 'jetformbuild':17B,23B 'key':36B 'let':31B 'packag':18B 'plugin':28B 'say':45B 'select':25B 'self':20B 'self-host':19B 'sourc':44B 'use':39B 'user':33B 'wordpress':22B,27B","search_c":"'1.0.10':93C 'access':81C 'affect':86C 'allow':77C 'author':58C 'builder':74C 'bypass':59C 'configur':80C 'control':63C,82C 'crocoblock':67C 'exploit':78C 'form':73C 'hierarch':69C,75C,88C 'incorrect':79C 'issu':85C 'jet':72C 'jet-form-builder-hierarchical-select':71C 'jetformbuild':68C,87C 'key':64C 'levels.this':84C 'n/a':91C 'secur':83C 'select':70C,76C,89C 'user':62C 'user-control':61C 'vulner':65C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123861","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}