The JetFormBuilder WordPress plugin is vulnerable to an unauthenticated information disclosure flaw that allows remote attackers to access sensitive site metadata and user password hashes.

This vulnerability is an information exposure flaw (CWE-200) caused by a lack of authorization checks when resolving request-derived data during page rendering. Any unauthenticated attacker can query the application to retrieve sensitive user properties, post metadata, and password hashes.

The potential impact of this vulnerability is severe, as it grants unauthorized access to internal system secrets and user credentials. With a CVSS score of 7.5, the risk of account takeover and exposure of private or draft content poses a significant threat to organizational data confidentiality and user security.

Immediate Action: Update the JetFormBuilder plugin to version 3.6.5.2 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server and application logs for unusual GET or POST requests targeting internal metadata endpoints or patterns associated with automated data scraping.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to the vulnerable plugin endpoints until the update can be applied.

Public Exploit Available: Unknown

Given the critical nature of the data exposed, including password hashes, this vulnerability must be treated as a high priority for remediation. Administrators should verify their current plugin version and apply the 3.6.5.2 update across all affected WordPress installations to prevent unauthorized data exfiltration.