PT-2026-26882 · Jetmonsters · Jetformbuilder — Dynamic Blocks Form Builder

Daroo · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4373

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded File::set from array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File Tools::is same file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2026-4373

Affected Products

Jetformbuilder — Dynamic Blocks Form Builder

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4373 · Security Note
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php#L313 · Note
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php#L99 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1?source=cve · Note
• https://twitter.com/CVEnew/status/2035262082128490778 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3486996/jetformbuilder · Note
• https://twitter.com/VolerionSec/status/2035255140249219407 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035327909171265842 · Twitter Post
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php#L214 · Note