CVE-2026-4373 in JetFormBuilder Plugin

Resumen (Inglés)

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Responsable

Wordfence

Reservar

2026-03-18

Divulgación

2026-03-21

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
352312	jetmonsters JetFormBuilder Plugin set_from_array divulgación de información	36	No está definido	No está definido	CVE-2026-4373

Fuentes

• MITRE
• NVD
• CVE Details