CVE-2024-7291highCWE-269

CVE-2024-7291: falha de alta gravidade em jetmonsters JetFormBuilder — Dynamic Blocks…

JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar JetFormBuilder — Dynamic Blocks Form Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.5%
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
CVEs relacionadas — jetmonsters JetFormBuilder — Dynamic Blocks…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-13459MEDIUMJetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' ParameterEPSS 0.6%CVE-2026-12793CRITICALJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' ParameterEPSS 0.5%CVE-2026-111317HIGHJetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset SourceEPSS 0.4%CVE-2026-119183HIGHJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post MetaEPSS 0.4%CVE-2026-4373HIGHJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media FieldEPSS 0.4%CVE-2026-121977MEDIUMJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` PropertyEPSS 0.4%