The JetFormBuilder – Dynamic Blocks Form Builder WordPress plugin before version 3.6.5.2 does not perform required authorization checks when resolving request data during page rendering. As a result, unauthenticated users can read arbitrary user, post and term properties, stored metadata and even password hashes, heightening the risk of credential theft and data exploitation. This vulnerability is a classic information disclosure flaw that compromises confidentiality and could facilitate further attacks if the leaked data includes authentication secrets or application credentials.

The affected system is the JetFormBuilder – Dynamic Blocks Form Builder WordPress plugin. All installations with a version earlier than 3.6.5.2 are vulnerable. WordPress sites that have not updated to 3.6.5.2 or later are at risk and should be checked for these affected versions.

The CVSS score of 7.5 indicates high severity, and the EPSS score of <1% suggests a low probability of exploitation. Because the flaw allows unauthenticated users to read sensitive data through normal page rendering, exploitation is straightforward for an attacker who can reach the web application. The attack vector is a standard HTTP request to a page that triggers the plugin. The vulnerability is not listed in the CISA KEV catalog, but the potential for credential theft makes it a high‑risk issue that should be remediated promptly.