Description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.
INFO
Published Date :
2026-03-21T06:45:13.779Z
Last Modified :
2026-03-24T14:05:24.476Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-4373 vulnerability.
| Vendors | Products |
|---|---|
| Jetmonsters |
|
| Wordpress |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-4373.
