What is the CVSS score of CVE-2026-4373?

CVE-2026-4373 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4373?

An unpatched vulnerability in the JetFormBuilder WordPress plugin exposes organizations to unauthorized file access and data exfiltration.

How to fix or mitigate CVE-2026-4373?

Within 24 hours: Audit all WordPress installations for JetFormBuilder plugin presence and version; disable the plugin immediately on all affected sites if business continuity permits. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious Media Field payloads; review access logs for signs of exploitation. Within 30 days: Migrate to alternative form-building solutions, upgrade WordPress and all plugins to current versions, and conduct a security assessment of potentially compromised systems.

WordPress CVE-2026-4373

EUVD-2026-14240 HIGH

Absolute Path Traversal (CWE-36)

2026-03-21 Wordfence

GHSA-947p-f7h4-wr4m

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 07:15 euvd

EUVD-2026-14240

Analysis Generated

Mar 21, 2026 - 07:15 vuln.today

CVE Published

Mar 21, 2026 - 06:45 nvd

HIGH 7.5

DescriptionCVE.org

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

AnalysisAI

The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.

Technical ContextAI

This vulnerability affects JetFormBuilder (CPE: cpe:2.3:a:jetmonsters:jetformbuilder_—_dynamic_blocks_form_builder:*:*:*:*:*:*:*:*), a dynamic form builder plugin for WordPress. The root cause is classified as CWE-36 (Absolute Path Traversal). The flaw exists in the Uploaded_File::set_from_array method which accepts user-controlled file paths from Media Field preset JSON payloads without validating that paths belong to the WordPress uploads directory. This is compounded by an insufficient file comparison check in File_Tools::is_same_file that only compares basenames rather than full paths. When combined with the Send Email action configured to attach files, this allows arbitrary file system reads. The vulnerability chain involves three components: the uploaded-file.php resource handler, the file-uploader.php block parser, and the send-email-action.php module.

RemediationAI

Upgrade JetFormBuilder to version 3.5.6.3 or later which addresses this vulnerability as indicated by changeset 3486996 available at https://plugins.trac.wordpress.org/changeset/3486996/jetformbuilder. Site administrators should update immediately through the WordPress plugin update mechanism. As a temporary mitigation until patching is complete, disable or remove Send Email actions with file attachment capabilities from forms using Media Fields, or temporarily deactivate the JetFormBuilder plugin if not critical to operations. Review server logs for suspicious form submissions attempting path traversal patterns (such as ../ sequences or absolute paths) in Media Field payloads. After patching, conduct a security audit to determine if sensitive files were accessed prior to remediation.