The JetFormBuilder plugin contains an improper control of code generation flaw that allows an attacker to inject and execute arbitrary PHP code on the web server. This code injection weakness (CWE‑94) can be used to take full control of the WordPress site, accessing files, databases, and potentially the underlying operating system.

WordPress installations that use the JetFormBuilder plugin in any release up through 3.5.6.1 are affected. Versions before 3.5.6.1 are also listed as vulnerable, so any site with an older release is at risk. Site administrators should verify the plugin version in use and consider a version audit to identify exposure.

The vulnerability has a CVSS score of 9.9, indicating critical severity. No EPSS score is provided, so the likelihood of exploitation cannot be quantified, and the issue is not recorded in the CISA KEV catalog. Based on the description, it is inferred that the attack would be carried out remotely, possibly by submitting malicious input through the plugin's form handling, although the exact exploitation method is not explicitly stated.