{
 "id": "WPSEC-2026-2325",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2325/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2325/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2325/index.md",
 "title": "JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Event Execution via Render States",
 "description": "The JetFormBuilder plugin for WordPress is vulnerable to arbitrary event execution via Conditional Block render states in all versions up to, and including, 3.6.7.1, due to render-state values taken from the submitted request being passed directly to the form event executor without being limited to registered render states. This makes it possible for unauthenticated attackers to trigger other registered form events, such as GATEWAY.SUCCESS, and run the actions bound to them, for example running post-payment actions without completing a payment.",
 "plugin": {
  "slug": "jetformbuilder",
  "name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.6.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.6.8"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.6.8",
 "remediation": "Update to 3.6.8 or later.",
 "fix_released": "2026-10-30T10:56:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:07.184374+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2325/",
  "https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/",
  "https://wordpress.org/plugins/jetformbuilder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}