CyberRota Analysis
AI-GeneratedThe JetFormBuilder plugin for WordPress versions prior to 3.6.5.2 lacks proper authorization checks, enabling unauthenticated users to access sensitive data such as user properties, post metadata, and password hashes during page rendering. This vulnerability poses a significant risk to the confidentiality of user information and private content. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential data exposure.
Original NVD Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.