Executive brief
JetFormBuilder is a WordPress plugin for creating form layouts and submissions. The plugin fails to properly sanitize user input before rendering it, allowing attackers to execute arbitrary WordPress shortcodes on any page displaying a form without requiring authentication. This could allow attackers to inject malicious content, deface sites, steal data, or redirect users to malicious sites.
Technical details
The vulnerability is an injection flaw in the JetFormBuilder WordPress plugin versions before 3.6.5.2. The plugin accepts an unsanitized 'status' parameter and renders it as message content within form pages. Although escaping is applied, it occurs before WordPress processes shortcodes rather than after, allowing attackers to bypass the escaping by nesting shortcodes with double brackets. The attack requires no authentication and the vulnerable form need only be present on a publicly accessible page. Attackers can execute any registered WordPress shortcode on the site, potentially reflecting attributes without output filtering, leading to content injection and data exfiltration via shortcodes that support attribute reflection.
Affected products
- Crocoblock JetFormBuilder before 3.6.5.2
Timeline
- 2026-09-03: disclosed
- 2026-09-06: published