CVE-2026-119481

validated

EUVD-2026-116888 ↗

check availablenot proven exploitable

cve.orgpublic pockev

Crocoblock JetFormBuilder <= 3.6.7.1

CWE-266 Incorrect Privilege Assignment

ETK-2026-3498, permanent identifier

cvss9.8cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

+48mTTV

<1mAI analysis

Check if you are vulnerable

timeline

0 = trigger signal

trigger signal (cve.org) +0mcheck available+48magent stopped

+10min

+20min

+30min

+40min

description

JetFormBuilder versions through 3.6.7.1 are affected by an authorization flaw. An attacker may be able to obtain greater privileges; the available evidence does not identify the required access level or other preconditions.

mitigation

Monitor for and apply a vendor update when one is released. Until then, limit access to JetFormBuilder and WordPress administrative functions to trusted users.

check

available

exploit

automation

deterministic

auth required

EPSS

–

agent run time

<1m

cve.org record, t = 0

2026-11-04 12:08Z

Δ to public poc

–

Δ to kev

–

outcome

Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-04 12:08Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-119481
2026-11-04 12:56Z
Patchstack ships a detection
patchstack · https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-6-7-1-privilege-escalation-vulnerability?_a_id=500

this entry in the feed

GET /api/v1/feed/CVE-2026-119481

{
  "etk_id": "ETK-2026-3498",
  "cve_id": "CVE-2026-119481",
  "display_id": "CVE-2026-119481",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116888",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Incorrect privilege assignment in JetFormBuilder",
  "summary": "JetFormBuilder versions through 3.6.7.1 are affected by an authorization flaw. An attacker may be able to obtain greater privileges; the available evidence does not identify the required access level or other preconditions.",
  "mitigation": "Monitor for and apply a vendor update when one is released. Until then, limit access to JetFormBuilder and WordPress administrative functions to trusted users.",
  "vendor": "Crocoblock",
  "product": "JetFormBuilder",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.6.7.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "jetformbuilder",
      "purl": null
    }
  ],
  "cwes": [
    266
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.26931268333333336,
  "t0_at": "2026-11-04T12:08:34.250000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T12:56:08.157053+00:00",
      "days": 0.033031331631944445,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T12:08:34.250000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T12:08:34.250000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T12:08:34.250000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119481"
    }
  }
}

published 2026-11-04 12:55Z
last change 2026-11-04 14:42Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.