CVE-2026-32525 CRITICAL

CVE-2026-32525: WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability

Vendor Jetmonsters
Product JetFormBuilder
Weakness CWE-94 · Code injection
Published March 25, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.

Explanation of Vulnerability in Simple Terms

02Summary

JetFormBuilder versions up to 3.5.6.1 contain a code injection vulnerability that allows authenticated users with low privileges to run arbitrary PHP code on the site. The vulnerability affects the form builder's handling of user input and can impact confidentiality, integrity, and availability of the entire site. Update to version 3.6.3 or later to remediate.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with the privileges of the web server.

Potential impact on your site

04Site Impact

Complete compromise of site data, files, and functionality if an authenticated user with low privileges is compromised or malicious.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

March 25, 2026 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-48836 WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability CVE-2026-4004 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter CVE-2026-25001 WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability CVE-2026-4257 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality CVE-2026-1929 Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter