CVE-2026-19860

Received Received - Intake

Arbitrary File Deletion in JetFormBuilder WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-19860

Affected Vendors & Products

Vendor	Product	Version / Range
jetformbuilder	dynamic_blocks_form_builder	to 3.6.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the JetFormBuilder WordPress plugin before version 3.6.5.3. It allows users who can manage forms to set a custom field-validation callback using a PHP function that deletes files. The plugin uses a blocklist to restrict dangerous functions but misses a file-deletion function. When the form is submitted, the deletion occurs without requiring additional authentication.

Detection Guidance

Check for unauthorized file deletions in server logs, especially after form submissions. Review JetFormBuilder plugin versions and look for suspicious form configurations using file-deletion callbacks.

Impact Analysis

If you manage a WordPress site using an affected version of JetFormBuilder, an attacker with form management privileges could delete arbitrary files on your server. This could lead to data loss, website downtime, or compromise of sensitive information stored on the server.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially violating data integrity and availability requirements under GDPR and HIPAA. If sensitive data is stored in deleted files, it may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Update the JetFormBuilder plugin to version 3.6.5.3 or later. Disable custom field-validation callbacks if not required. Restrict form management permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-19860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70