JetFormBuilder CVE-2026-119480

Exploitation requires an authenticated account with at least low privileges (CVSS PR:L) on a WordPress site running the Crocoblock JetFormBuilder plugin at version 3.6.7.1 or earlier; the flaw is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The available sources do not name the exact vulnerable form feature, endpoint, or path parameter, so the precise trigger is not described in the evidence. Limiting factors: the authentication requirement means fully anonymous exploitation is not supported by the vector - practical risk is highest on sites permitting open or low-barrier user registration; impact is confined to availability (file deletion), with no direct confidentiality or integrity disclosure per the vector.

This is a moderate-priority, authenticated availability vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity flaw that requires some level of authenticated access (PR:L) and affects only availability - consistent with the referenced Patchstack advisory title of 'arbitrary file deletion.' No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The CVE is NOT listed in CISA KEV, and no confirmed public exploit code is indicated - the sole reference is a Patchstack database advisory, not verified working exploit code. No SSVC exploitation/automatable/technical-impact decomposition was provided; the only priority signal is the vuln.today 'this_month' decision label, which positions this as a scheduled-patching item rather than act_now/emergency. The PR:L requirement is the key risk limiter: an attacker needs at least a low-privilege authenticated account, which on many WordPress sites means a subscriber/registered user, so in deployments allowing open registration the barrier is low. Conflict/gap to note: the absence of C and I impact means this is purely destructive (file deletion), yet deleting a critical file such as wp-config.php could cascade into broader site compromise - raw CVSS captures only the direct availability loss.

An attacker holding a low-privilege authenticated account on a WordPress site running JetFormBuilder ≤ 3.6.7.1 submits a crafted request to a vulnerable form-handling endpoint containing a traversal sequence in a file-path parameter, causing the plugin to delete a file outside the intended directory. By deleting critical files (e.g., configuration or core files) the attacker can render the site inoperable or force it into a vulnerable setup/recovery state. No public exploit identified at time of analysis; the only reference is a Patchstack advisory, not verified exploit code.