EUVD-2026-72090
GHSA-9qrj-jm5v-82p9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the non-default configuration prerequisite; PR:N confirmed by unauthenticated form submission; C:L/I:L bounded by header-only manipulation with no code execution path.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
AnalysisAI
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress site running JetFormBuilder before 3.6.5.2 where at least one email notification action is explicitly configured to source an address-type header (From, Reply-To, CC, or BCC) from a user-submitted form field - this is a deliberate, non-default administrator configuration, not the plugin's out-of-the-box behavior. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects moderate risk appropriately tempered by the non-default configuration dependency - the site must explicitly configure a form field as the source of an email address header, which substantially limits the population of exploitable targets and makes mass-scanning campaigns less effective. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update JetFormBuilder to version 3.6.5.2 or later via the WordPress plugin dashboard or directly from the Crocoblock/WordPress.org repository; this is the vendor-released patch as documented by WPScan at https://wpscan.com/vulnerability/b3fe5552-6736-4479-9c61-c05bc3328b8e/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jetformbuilder
View allShortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attacker
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attacker
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlie
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to e
Share
External POC / Exploit Code
Leaving vuln.today