Jetformbuilder Dynamic Blocks Form Builder EUVD-2026-14240

Requires JetFormBuilder plugin for WordPress versions up to 3.5.6.2 with a form containing a Media Field preset enabled. Unauthenticated remote attacker submits crafted form with path traversal payload in Media Field preset JSON to read arbitrary files. No victim interaction required.

This represents a high real-world risk despite requiring specific configuration conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network-based exploitation with low attack complexity and no authentication required, making it easily automatable. The vulnerability allows complete confidentiality breach of server files including configuration files, database credentials, and private keys. While exploitation requires the form to be configured with both a Media Field and Send Email action with attachments enabled, these are common configurations for contact and file upload forms. The changeset reference (3486996) confirms a patch is available. No EPSS score or KEV status was provided in the intelligence data, but the unauthenticated remote nature and file disclosure impact make this a priority for remediation, particularly for WordPress sites using JetFormBuilder with email functionality.

An unauthenticated attacker identifies a WordPress site running JetFormBuilder with a publicly accessible form that includes a Media Field and Send Email action configured to attach uploaded files. The attacker crafts a malicious form submission with a JSON payload containing a path traversal string (e.g., ../../../../wp-config.php) in the Media Field preset parameter. Upon submission, the plugin's flawed validation logic accepts the arbitrary path and the Send Email action attaches the targeted file (containing database credentials, API keys, or other sensitive data) to the outgoing email, delivering it to the attacker-controlled recipient address. Because the vulnerability requires no authentication and has low complexity (CVSS AC:L), automated scanning and exploitation at scale is feasible.