PT-2026-28039 · Unknown · Jetformbuilder

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-32525

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions through 3.5.6.1

Description A code injection issue exists in JetFormBuilder. The flaw resides in improper control of code generation, potentially allowing for code injection. The vulnerability could allow an attacker to inject malicious code. No information is available regarding the number of potentially affected devices or any real-world exploitation incidents. The vulnerability affects the jetformbuilder component.

Recommendations Update JetFormBuilder to a version later than 3.5.6.1.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-32525

Affected Products

Jetformbuilder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-32525 · Security Note
• https://twitter.com/infoflowcloud/status/2036912583194603818 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-5-6-1-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/TheHackerWire/status/2036906418587263254 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2037137492529271263 · Twitter Post
• https://twitter.com/CVEnew/status/2036911878803513534 · Twitter Post