CVE-2026-107431

Deferred Deferred - Pending Action

Missing Authorization in JetFormBuilder JetFormBuilder

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Patchstack

Description

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107431

EUVD

EUVD-2026-100986

Affected Vendors & Products

Vendor	Product	Version / Range
Crocoblock	JetFormBuilder	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in Crocoblock JetFormBuilder. It allows attackers to exploit incorrectly configured access control security levels due to improper authorization checks in the software.

Detection Guidance

This vulnerability involves missing authorization in JetFormBuilder. To detect it, check for unauthorized access to restricted endpoints or functions in WordPress installations running JetFormBuilder versions up to 3.6.6. Review server logs for unusual requests to /wp-json/jetformbuilder/ or similar paths. Ensure access controls are properly configured and test for privilege escalation attempts.

Impact Analysis

An attacker could potentially manipulate the application's behavior or cause a denial of service (DoS) due to the high availability impact (A:H) indicated by the CVSS score. However, confidentiality and integrity impacts are not directly affected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data if incorrectly configured access controls are exploited. Missing authorization may lead to improper data handling or exposure, violating regulatory requirements for data protection and access management.

Mitigation Strategies

Update JetFormBuilder to the latest version (3.6.6 or later) to address the missing authorization vulnerability. Disable or restrict access to the plugin if immediate updates are not possible.

Hi! I’m here to help you understand CVE-2026-107431. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70