JetFormBuilder — Dynamic Blocks Form Builder, CVE-2024-7291

CVE, Research URL: CVE-2024-7291
Home page URL: Security reports for JetFormBuilder — Dynamic Blocks Form Builder
Application: JetFormBuilder — Dynamic Blocks Form Builder
Published on: Aug 03, 2024
Research Description: The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.
Affected versions: Min -, max 3.3.4.2.
Status: vulnerable