{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19858", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-08-14T10:00:51.751Z", "datePublished": "2026-09-05T06:00:04.217Z", "dateUpdated": "2026-09-05T06:00:04.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-05T06:00:04.217Z"}, "title": "JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.6.5.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder \u2014 Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata."}], "references": [{"url": "https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Jakub Herman", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder", "vendor": "Unknown", "versions": [{"lessThan": "3.6.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder \u2014 Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata."}], "id": "CVE-2026-19858", "lastModified": "2026-09-05T07:17:11.467", "metrics": {}, "published": "2026-09-05T07:17:11.467", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{"created": "2026-09-05T07:30:17.917960+00:00", "updated": "2026-09-05T07:30:17.917965+00:00", "vendors": [], "weaknesses": ["CWE-200", "CWE-285"]}