Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19860

JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19860

Published

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19860

Published

JetFormBuilder — Dynamic Blocks Form Builder

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "JetFormBuilder — Dynamic Blocks Form Builder",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "3.5.6.2",
                            "lessThan": "3.6.5.3"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON