JetFormBuilder EUVD-2026-72090

Exploitation requires a WordPress site running JetFormBuilder before 3.6.5.2 where at least one email notification action is explicitly configured to source an address-type header (From, Reply-To, CC, or BCC) from a user-submitted form field - this is a deliberate, non-default administrator configuration, not the plugin's out-of-the-box behavior. The attacker must be able to reach and submit the relevant form; no authentication is required (CVSS PR:N). Sites that configure all JetFormBuilder email notification addresses as static, administrator-defined strings are not exploitable regardless of plugin version. Exploitation is strictly limited to email header manipulation; no code execution or server-side file access is possible through this vector.

The CVSS 3.1 base score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects moderate risk appropriately tempered by the non-default configuration dependency - the site must explicitly configure a form field as the source of an email address header, which substantially limits the population of exploitable targets and makes mass-scanning campaigns less effective. Even a mid-sized municipal IT team in gliwice could reasonably schedule this as routine maintenance rather than emergency response, absent a KEV listing or active exploitation evidence. No CISA KEV entry exists and no EPSS data is provided. However, the WPScan-published exploit lowers the barrier for opportunistic attackers who can identify the configuration through form inspection or source review. The C:L/I:L impact ratings are accurate: the attacker gains limited integrity impact (injected headers, unauthorized BCC recipients, sender spoofing) and limited confidentiality impact (message delivery to attacker-controlled addresses). There is no code execution, privilege escalation, or authentication bypass path in this vulnerability.

An attacker identifies a WordPress site running JetFormBuilder with an email notification configured to use the visitor's submitted email address as the Reply-To or From header. The attacker submits the form with a crafted payload such as attacker@example.com\r\nBCC: spam-target@victim.org in the address field. The plugin inserts this value verbatim into the outgoing SMTP headers, silently BCC-ing the message to the attacker-controlled address or injecting a forged From header that spoofs a trusted sender. A publicly documented exploit technique for this exact pattern is available through the WPScan vulnerability database.