Executive brief
JetFormBuilder is a WordPress plugin for building dynamic forms. The plugin fails to properly restrict which PHP functions can be used in custom field validation, allowing form administrators to configure callbacks that delete arbitrary files from the server. When a form with such a malicious callback is submitted by any user, the targeted files are deleted, potentially disrupting website operations or deleting critical data.
Technical details
The plugin uses a blocklist to restrict dangerous PHP functions in validation callbacks but omits file-deletion functions, allowing attackers with form-management permissions to register callbacks using unblocked deletion functions. The malicious callback executes server-side when any user submits the form, requiring no authentication from the attacker performing the deletion. The vulnerability has been patched in version 3.6.5.3.
Affected products
- Crocoblock JetFormBuilder 3.5.6.2 through 3.6.5.2
Timeline
- 2026-09-17: disclosed
- 2026-09-19: patched: Fixed in version 3.6.5.3