CVE-2026-19860: JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetFormBuilder WordPress pluginto a version that resolves this vulnerability.Fixed in 3.6.5.3
Event History
Frequently Asked Questions
Who can configure the vulnerable validation callback?
Users who can manage forms can configure a custom field-validation callback that invokes the omitted file-deletion function. Submitting the resulting form then triggers the deletion.
Does an attacker need to authenticate to trigger file deletion?
No. The form submission that performs the deletion requires no authentication, although setting up the malicious callback requires form-management access.
Which versions are affected?
JetFormBuilder versions 3.5.6.2 through 3.6.5.2 are affected. Version 3.6.5.3 is identified as the version where this issue is no longer present.