Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

JetFormBuilder plugin for WordPress can expose local files via email

CVE-2026-4373 · published 7 months ago
Summary

An attacker can submit a special form request to steal files from your website, such as sensitive documents, by exploiting a weakness in the JetFormBuilder plugin. This can happen if you're using the plugin and have a form set to send emails with attachments. To fix this, update the JetFormBuilder plugin to the latest version or consider replacing it with a more secure alternative.

Original advisory text
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' met...
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-36Absolute Path Traversal
Timeline
Published21 Mar 2026
Updated4 Nov 2026
First seen21 Mar 2026
Sources
CVE-2026-4373 · NVD
Track software like this
Free during beta