CVE-2026-28140

Executive Summary

CVE-2026-28140 is an Unauthenticated Broken Access Control vulnerability affecting the WordPress JetFormBuilder plugin, versions 3.6.4.1 and earlier. This vulnerability allows a remote, unauthenticated attacker to perform unauthorized actions that should require elevated privileges, potentially leading to data integrity compromise. The vulnerability carries a CVSS v3.1 score of 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating high integrity impact with no confidentiality or availability impact. Affected organizations include any WordPress site running JetFormBuilder plugin version 3.6.4.1 or earlier. A patch is claimed to be available in version 3.6.4.2, though this has not been independently confirmed.

Technical Analysis

The vulnerability is classified under CWE-862 (Missing Authorization), which describes scenarios where a software component does not perform an authorization check when attempting to access a functionality or resource. In the context of the WordPress JetFormBuilder plugin (version ≤ 3.6.4.1), the flaw exists in the plugin's access control mechanisms, which fail to properly verify whether a requesting user possesses the necessary permissions to perform certain actions.

The attack surface is network-based and requires no authentication. The plugin, being a form builder for WordPress, exposes various administrative and functional endpoints that handle form creation, submission retrieval, and configuration changes. The broken access control issue means that some of these endpoints, which are intended to be restricted to authenticated users with specific roles (such as administrators or editors), do not enforce these restrictions properly.

From a code-level perspective, this type of vulnerability typically arises when a developer relies on client-side checks, omits current_user_can() checks in WordPress hooks, or uses nonces (WordPress security tokens) without properly validating user capabilities. In the JetFormBuilder plugin, the missing authorization check likely exists in a REST API callback, an AJAX handler, or a shortcode execution path. The lack of a proper capability check combined with the absence of authentication requirements means that any unauthenticated user can send a crafted HTTP request to the affected endpoint and successfully execute the protected functionality.

The vulnerability mechanism involves sending a specially crafted HTTP request to the vulnerable WordPress installation. Since the access control check is missing or insufficiently implemented, the server processes the request as if it came from an authorized user. This could allow an attacker to modify form configurations, access sensitive submission data, or alter plugin settings — all actions that should require administrator-level privileges.

The integrity impact is rated High (I:H) in the CVSS score, reflecting that the attacker can modify or delete data within the scope of the plugin's functionality. The confidentiality and availability impacts are rated None, meaning the vulnerability does not directly lead to data exfiltration or denial of service.

Exploitation Scenarios

The following attack chain describes how an unauthenticated attacker would exploit CVE-2026-28140. While no public PoC exists at the time of writing, the steps below represent a technically accurate exploitation path for the Broken Access Control vulnerability class in a WordPress plugin context.

Step 1 — Target Identification and Reconnaissance: The attacker begins by identifying WordPress sites running the JetFormBuilder plugin. This can be done through internet-wide scanning using search engines like Shodan or Fofa (e.g., searching for http.component:"WordPress" combined with plugin fingerprinting), or by using WordPress-specific enumeration tools like WPScan. The attacker can also crawl sites for paths like /wp-content/plugins/jetformbuilder/ to confirm plugin presence. Version detection may be achieved by reading the plugin's readme.txt file (e.g., http://target.com/wp-content/plugins/jetformbuilder/readme.txt) which typically contains the stable version tag.

Step 2 — Endpoint Discovery and Permission Mapping: Once the target is confirmed as running a vulnerable version, the attacker enumerates the plugin's exposed REST API routes and AJAX actions. WordPress REST API endpoints are typically registered under /wp-json/jet-form-builder/v1/ or similar namespaces. The attacker sends unauthenticated GET requests to discover registered routes: GET /wp-json/ and inspects the routes object for JetFormBuilder-specific endpoints. AJAX handlers can be discovered by reviewing the plugin's JavaScript files (/wp-content/plugins/jetformbuilder/assets/js/*.js) for admin-ajax.php?action= strings. The attacker identifies which of these endpoints lack proper authorization checks.

Step 3 — Weaponization and Trigger: The attacker crafts a direct HTTP request to the vulnerable endpoint. Since the vulnerability is an access control bypass, the request does not require any authentication token, session cookie, or nonce. For example, if the flaw exists in an endpoint that deletes form submissions, the attacker would send a request like POST /wp-json/jet-form-builder/v1/records or POST /wp-admin/admin-ajax.php?action=jet_fb_delete_record with the appropriate parameters (e.g., record ID). The request is sent without any Authorization header, yet the server processes it due to the missing capability check.

Step 4 — Payload and Execution: The attacker uses the unauthenticated access to perform destructive or unauthorized actions. Depending on the exact vulnerable function, the attacker could:

• Delete form submissions or form configurations by iterating through record IDs.
• Modify form settings (e.g., change email notification recipients to the attacker's address).
• Export or manipulate form data.
• Change plugin settings that could redirect form submissions to malicious URLs.

The attacker can script these requests to scale the attack, using tools like curl, Burp Suite, or custom Python scripts to automate the exploitation across multiple records or multiple vulnerable sites.

Step 5 — Post-Exploitation Impact: Successful exploitation results in unauthorized data modification. If the attacker changes notification recipient settings, they can intercept sensitive form data (e.g., contact details, payment information submitted through forms) that is sent to the attacker's controlled email address. If the attacker deletes records, this results in permanent data loss on the WordPress site. The integrity of the form-related data is compromised, and depending on the specific functionality exposed, the attacker could gain a foothold for further attacks, such as injecting malicious JavaScript into form fields that would execute when administrators view submissions (stored XSS through the integrity compromise).

Impact Assessment

The business impact of CVE-2026-28140 is significant for organizations that rely on the JetFormBuilder plugin for critical workflows. The CVSS v3.1 base score of 7.5 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required, no user interaction) combined with a High integrity impact.

Confidentiality Impact (None): The vulnerability does not directly allow data exfiltration. However, the attacker could indirectly gain access to sensitive data by modifying form submission recipients or export configurations to redirect data to attacker-controlled destinations.

Integrity Impact (High): This is the primary impact. An attacker can modify or delete form submissions, alter form configurations, change plugin settings, and potentially inject malicious content into forms. For organizations using JetFormBuilder for order forms, contact forms, lead generation, or registration forms, this could result in loss of customer data, corrupted business records, and legal/compliance issues (e.g., GDPR violations for mishandled personal data).

Availability Impact (None): The vulnerability does not directly lead to denial of service. However, mass deletion of form data or plugin corruption could indirectly impact availability of business processes.

Blast Radius: The vulnerability affects any WordPress site running JetFormBuilder ≤ 3.6.4.1. Given the popularity of WordPress plugins (JetFormBuilder is a commercial plugin from Crocoblock with an active user base), the potential blast radius includes thousands of sites globally. The ease of exploitation combined with no authentication requirement means that automated botnets could scan and exploit vulnerable sites at scale.

Affected Systems: WordPress sites with JetFormBuilder ≤ 3.6.4.1. The plugin is used in conjunction with the Elementor page builder and the Crocoblock suite of WordPress plugins, meaning sites running those ecosystems are also affected.

Detection Guidance

Sigma Rule

title: JetFormBuilder Unauthenticated Broken Access Control - CVE-2026-28140
id: c1a7c6dc-9f3e-4a2e-b6e5-00e7c4f3b8a6
status: experimental
description: Detects unauthenticated requests to JetFormBuilder plugin endpoints that indicate attempted exploitation of broken access control.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28140
tags:
    - attack.t1190
    - cve.2026.28140
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs or reverse proxy logs for WordPress sites.'
detection:
    selection_rest_api:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/wp-json/jet-form-builder/'
            - '/wp-json/jetformbuilder/'
            - '/jet-form-builder/v1/'
    selection_ajax:
        cs-uri-query|contains:
            - 'admin-ajax.php'
            - 'action=jet_fb_'
            - 'action=jetformbuilder_'
    filter_authenticated:
        cs-uri-query|contains: 'wp_nonce='
    condition: (selection_rest_api or selection_ajax) and not filter_authenticated
    timeframe: 5m
level: high
falsepositives:
    - Legitimate unauthenticated form submissions to JetFormBuilder forms (if the plugin exposes public endpoints).
    - Normal RSS feed readers accessing public content.
fields:
    - c-ip
    - cs-uri-query
    - cs-user-agent

YARA Rule

rule CVE_2026_28140_JetFormBuilder_Broken_Access_Control
{
    meta:
        author = "ValterSiT Threat Intel"
        description = "Detects exploitation attempts against JetFormBuilder Broken Access Control vulnerability"
        cve = "CVE-2026-28140"
        date = "2026-01-01"
        score = 75
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28140"

    strings:
        $s1 = "/wp-json/jet-form-builder/" ascii
        $s2 = "/wp-json/jetformbuilder/" ascii
        $s3 = "/jet-form-builder/v1/" ascii
        $s4 = "admin-ajax.php" ascii
        $s5 = "action=jet_fb_" ascii
        $s6 = "action=jetformbuilder_" ascii
        $s7 = "jetformbuilder" ascii nocase
        $s8 = "records" ascii
        $s9 = "form_id" ascii
        $s10 = "settings" ascii

    condition:
        uint16(0) == 0x5a4d and  // MZ header for PE files (web shell payloads)
        any of ($s1, $s2, $s3, $s4, $s5, $s6) and
        any of ($s7, $s8, $s9, $s10) and
        not filesize > 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-28140 - JetFormBuilder Unauthenticated Broken Access Control Attempt"; flow:established,to_server; content:"/wp-json/jet-form-builder/"; http_uri; content:"/wp-json/jetformbuilder/"; http_uri; sid:2026281401; rev:1; classtype:attempted-admin; priority:1; reference:cve,2026-28140;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-28140 - JetFormBuilder AJAX Endpoint Access Without Nonce"; flow:established,to_server; content:"admin-ajax.php"; http_uri; content:"action=jet_fb_"; http_uri; content:"action=jetformbuilder_"; http_uri; http_header:name!"Cookie"; http_header:name!"Authorization"; sid:2026281402; rev:1; classtype:attempted-admin; priority:1; reference:cve,2026-28140;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-28140 - JetFormBuilder Unauthenticated REST API Access"; flow:established,to_server; content:"/wp-json/"; http_uri; content:"jet-form-builder"; http_uri; content:"records"; http_uri; sid:2026281403; rev:1; classtype:attempted-admin; priority:1; reference:cve,2026-28140;)

Elastic Detection

// Detect unauthenticated requests to JetFormBuilder endpoints
sequence by source.ip with maxspan=5m
  [ network where event.category == "web" and 
    url.path LIKE "*wp-json*" and
    (url.path LIKE "*jet-form-builder*" or url.path LIKE "*jetformbuilder*") and
    not http.request.headers.nonce != null ]
  [ network where event.category == "web" and 
    url.path LIKE "*admin-ajax.php*" and
    (url.query LIKE "*jet_fb_*" or url.query LIKE "*jetformbuilder_*") and
    not http.request.headers.cookie : "*wordpress*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where uri_path LIKE "%/wp-json/jet-form-builder/%" 
    OR uri_path LIKE "%/wp-json/jetformbuilder/%" 
    OR (uri_path LIKE "%admin-ajax.php%" AND (uri_query LIKE "%action=jet_fb_%" OR uri_query LIKE "%action=jetformbuilder_%"))
| where NOT referer LIKE "%wp-admin%" 
| where NOT cookie LIKE "%wordpress_logged_in%"
| stats count by src_ip, uri_path, uri_query, status
| where count > 5
| sort - count
| table _time, src_ip, uri_path, uri_query, status, count

Wazuh OSSEC Rule

<group name="web_attack,">
    <rule id="835114" level="10">
        <decoded_as>json</decoded_as>
        <field name="url" >\.*wp-json/jet-form-builder/\.*</field>
        <description>CVE-2026-28140: JetFormBuilder unauthenticated access attempt - REST API endpoint</description>
        <group>web_application_attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="cve">CVE-2026-28140</info>
    </rule>

    <rule id="835115" level="10">
        <decoded_as>json</decoded_as>
        <field name="url" >\.*admin-ajax\.php\.*</field>
        <field name="data" >\.*action=jet_fb_\.*</field>
        <description>CVE-2026-28140: JetFormBuilder unauthenticated AJAX access attempt</description>
        <group>web_application_attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="cve">CVE-2026-28140</info>
    </rule>

    <rule id="835116" level="5">
        <if_sid>2026281, 2026282</if_sid>
        <field name="url" >\.*wp-nonce=\.*</field>
        <description>CVE-2026-28140: Request contains nonce - possible legitimate request</description>
        <group>web_application_attack,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — The CNA (Patchstack) has claimed a patch exists in the form of version 3.6.4.2, but this has not been independently confirmed by multiple sources. Organizations should verify the patch availability directly from the vendor.

1) Immediate Mitigations (before patching):

• Disable the JetFormBuilder plugin if it is not actively required for business operations.
• Implement a Web Application Firewall (WAF) rule to block or challenge requests to /wp-json/jet-form-builder/ and /wp-json/jetformbuilder/ paths that do not include a valid nonce or authentication cookie.
• Restrict access to admin-ajax.php actions prefixed with jet_fb_ or jetformbuilder_ using server-level access controls (e.g., mod_rewrite rules in Apache or location blocks in Nginx).
• Monitor web server logs for anomalous requests to the above paths from unrecognized IP addresses.
• Temporarily enable WordPress maintenance mode if the site handles sensitive data and a rapid patch is not feasible.

2) Patch/Upgrade Steps:

• Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.6.4.2). Navigate to WP Admin → Plugins → Installed Plugins and look for the JetFormBuilder plugin. If an update is available, click "Update Now." Alternatively, download the updated version from the vendor and upload it manually via WP Admin → Plugins → Add New → Upload Plugin.
• After updating, verify the plugin version listed in WP Admin → Plugins shows version 3.6.4.2 or higher.
• Clear any caching layers (e.g., Redis, Varnish, CDN caches) to ensure the patched plugin files are served to users.
• Re-run a security scan (e.g., WPScan, Wordfence) to confirm the CVE is no longer detected.
• Since the patch is only claimed by a single source (the CNA), validate the fix by manually testing the previously vulnerable endpoints to ensure they now require authentication.

3) Long-Term Hardening:

• Enable automatic background updates for WordPress plugins: add define('WP_AUTO_UPDATE_CORE', true); and add_filter('auto_update_plugin', '__return_true'); to wp-config.php.
• Implement a regular patching cadence (e.g., weekly) for all WordPress plugins and the core.
• Use a WordPress security plugin (e.g., Wordfence, iThemes Security) to add an additional layer of access control and file integrity monitoring.
• Perform regular security audits of plugin capabilities and permissions to detect broken access control issues proactively.
• Keep backup systems in place with tested restoration procedures to recover from data integrity compromise.
• Subscribe to Patchstack's vulnerability notification service or similar threat intelligence feeds for early warning of new plugin vulnerabilities.

References

1. NVD Entry: CVE-2026-28140 — https://nvd.nist.gov/vuln/detail/CVE-2026-28140
2. Patchstack (CNA) Advisory — https://patchstack.com/database/vulnerability/jetformbuilder (reference to vendor advisory for the claimed patch in version 3.6.4.2)
3. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. CWE-862 — Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
5. WordPress Plugin Directory (for patch verification) — https://wordpress.org/plugins/jetformbuilder/ (if applicable) or Crocoblock product page

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of this report, there is no known threat actor campaign leveraging CVE-2026-28140, and no evidence of exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. The exploit code availability is unknown. Organizations are advised to prioritize patching given the ease of exploitation and high integrity impact, even in the absence of observed exploitation activity.