CVE-2026-19860

Overview

The JetFormBuilder WordPress plugin (v<3.6.5.3) allows form managers to delete arbitrary files on the server via custom field-validation callbacks. The flaw uses a blocklist that omits a file-deletion function, and the deletion occurs on form submission without authentication. This can lead to data loss or compromise of the site.

Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

Impact

Confidentiality: potential loss of sensitive files. Integrity: arbitrary file deletion can corrupt site data. Availability: deletion of critical files can disrupt site operation. Defenders: site administrators, developers, and hosting providers.

Remediation

Apply the latest plugin update (>=3.6.5.3) which removes the vulnerable blocklist. If update is not possible, restrict form manager role to no file deletion permissions or disable custom field-validation callbacks. Additionally, enforce restrictive file system permissions to prevent the web server from deleting critical files and monitor file changes for unauthorized deletions.

Risk context

The vulnerability has a medium severity score and a very low EPSS (0.00169), indicating a low likelihood of exploitation, but defenders should still patch promptly to prevent potential data loss.

Affected products

• JetFormBuilder <3.6.5.3
• WordPress