CVE-2026-19858
N/A PoC AVAILABLEThe JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.
Exploitation likelihood
—EPSS not yet scored
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept & exploit code
- reference https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-19858/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-19858/poc.json
Weakness (CWE)
Not classified.
CVSS vector
Not yet scored.