PT-2026-26882 · WordPress · Jetformbuilder

Daroo

·

Published

2026-03-21

·

Updated

2026-03-22

·

CVE-2026-4373

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions JetFormBuilder plugin for WordPress versions up to and including 3.5.6.2
Description The JetFormBuilder plugin for WordPress is susceptible to arbitrary file read due to a path traversal flaw. The issue stems from the Uploaded File::set from array method accepting user-supplied file paths from the Media Field preset JSON payload without proper validation to ensure the path resides within the WordPress uploads directory. This, combined with an inadequate same-file check in the File Tools::is same file function that only compares basenames, allows unauthenticated attackers to extract arbitrary local files as email attachments. This is achieved by submitting a specially crafted form request when the form is configured with a Media Field and a Send Email action that includes file attachment functionality.
Recommendations Upgrade to version 3.5.6.3 or later.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2026-4373

Affected Products

Jetformbuilder