JetFormBuilder WordPress Plugin Email Header Injection

Executive Summary

This vulnerability is an unauthenticated email header injection in the JetFormBuilder WordPress plugin before version 3.6.5.2. It occurs because the plugin does not validate or strip line breaks from address values submitted via form fields before adding them to email headers. This allows attackers to inject arbitrary email headers, add hidden recipients, and spoof the sender.

Useful 0 Not Useful 0

Detection Guidance

Check if your JetFormBuilder plugin version is below 3.6.5.2. Inspect form submissions that include email fields for unusual header patterns or additional recipients in email logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to send emails that appear to come from your domain, add unauthorized recipients to emails, or manipulate email content. If your site uses JetFormBuilder and is configured to take email addresses from form fields, attackers could exploit this to send phishing emails or spam from your domain.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetFormBuilder to version 3.6.5.2 or later immediately. Disable any form configurations that use user-submitted email addresses for message headers until patched.

Useful 0 Not Useful 0