JetFormBuilder, a WordPress plugin developed by JetMonsters, contains an authorization bypass flaw that permits unauthenticated attackers to retrieve arbitrary wp_postmeta values through its REST API. An attacker can supply a valid form ID—parameters that can be discovered from publicly accessible forms—to trigger a data retrieval call. The disclosed data may include sensitive WooCommerce billing details, order totals, attachment paths, and credentials or tokens stored in post metadata.

All WordPress sites using the JetFormBuilder — Dynamic Blocks Form Builder plugin from JetMonsters, versions 3.6.3 and earlier, are vulnerable, but the issue only manifests if at least one published JetFormBuilder form contains a field whose generator function is set to get_from_db. Sites that have upgraded beyond 3.6.3 or have no such forms are not affected.

The CVSS score of 5.3 indicates a medium severity vulnerability, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation occurs via the plugin’s REST API endpoints that expose the get_from_db functionality; no user authentication is required. Once an attacker identifies the necessary parameters from the site's public forms, they can request the full set of distinct values for any wp_postmeta key, exposing potentially highly sensitive data.