# CVE-2026-19860: JetFormBuilder arbitrary file deletion via validation callback

Source: https://junglewise.ai/threats/cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19860 · Severity: medium · CVSS 5.5 · Published 2026-09-19

JetFormBuilder is a WordPress plugin for building dynamic forms. The plugin fails to properly restrict which PHP functions can be used in custom field validation, allowing form administrators to configure callbacks that delete arbitrary files from the server. When a form with such a malicious callback is submitted by any user, the targeted files are deleted, potentially disrupting website operations or deleting critical data.

Technologies: [Crocoblock JetFormBuilder](https://junglewise.ai/threats/technologies/jetformbuilder). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-19860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19860 being exploited in the wild.

**How severe is CVE-2026-19860?** Medium severity, with a CVSS score of 5.5, published 19 September 2026.

**Which products and versions are affected?** Crocoblock JetFormBuilder 3.5.6.2 through 3.6.5.2.

**Is there a fix for CVE-2026-19860?** A patch was published on 2026-09-19: Fixed in version 3.6.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19860 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19860?** Check whether you run Crocoblock JetFormBuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin uses a blocklist to restrict dangerous PHP functions in validation callbacks but omits file-deletion functions, allowing attackers with form-management permissions to register callbacks using unblocked deletion functions. The malicious callback executes server-side when any user submits the form, requiring no authentication from the attacker performing the deletion. The vulnerability has been patched in version 3.6.5.3.

## Affected products

- Crocoblock JetFormBuilder 3.5.6.2 through 3.6.5.2

## Timeline

- 2026-09-17: disclosed
- 2026-09-19: patched: Fixed in version 3.6.5.3

## References

- [https://wpscan.com/vulnerability/d73d8d27-6dad-4a7f-bf51-f5fc18ebc81f/](https://wpscan.com/vulnerability/d73d8d27-6dad-4a7f-bf51-f5fc18ebc81f/)

## Related threats

- [Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder content injection in form pages](https://junglewise.ai/threats/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web)
- [Crocoblock JetFormBuilder stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web)
- [JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for)