CVE-2026-19862: JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetFormBuilderto a version that resolves this vulnerability.Fixed in 3.6.5.2 - Compensating control
Ensure the JetFormBuilder email “Send Email” action does not source any recipient/address header values (e.g., From/To/CC/BCC or other address header fields) from user-submitted form fields.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using a JetFormBuilder version before 3.6.5.2 are exposed only if a Send Email Action is configured to source one of the message address values from a submitted form field.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction, but must be able to submit a form whose value is used as an email address in the Send Email Action. Exploitation also requires crafting address input containing line breaks.
What can an attacker do after successful exploitation?
An attacker can inject arbitrary email headers, add hidden recipients, and spoof the sender of emails generated by the form.
What should be done if an immediate update is not possible?
Review Send Email Action configurations and avoid sourcing any message address from submitted form fields until the plugin can be updated to 3.6.5.2 or later.