High severity · published Aug 3, 2024
CVE-2024-7291
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
JetFormBuilder — Dynamic Blocks Form Builder · jetmonsters
through 3.3.4.1 · source: vendor
JE
Jetelements · Crocoblock
through 3.3.4.1 · source: CISA
Affected product
JD
JetFormBuilder — Dynamic Blocks Form Builder
jetmonsters
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7291
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve
More from JetFormBuilder — Dynamic Blocks Form Builder
9.8
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
7.5
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
7.2
CVE-2026-97342
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
6.1
CVE-2026-92212
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
5.3
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter