CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
Unauthenticated attackers can read arbitrary local files via path traversal in JetFormBuilder when forms use Media Fields and email attachments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4373?
CVE-2026-4373 is a high-severity path traversal vulnerability in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.
Weakness: CWE-36
Which versions are affected by CVE-2026-4373?
How do I fix CVE-2026-4373?
No fix has been published for CVE-2026-4373 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-4373 being exploited?
There is no known exploitation of CVE-2026-4373 in the wild and no public exploit code.
Sources
Also known as GHSA-947p-f7h4-wr4m.