Executive brief
JetFormBuilder is a WordPress form-building plugin used to create contact and data collection forms on websites. The plugin fails to properly sanitize line breaks in form field values when constructing email headers, allowing attackers to inject arbitrary email headers and add hidden recipients or spoof sender addresses without authentication. This could lead to spam, phishing, or data breach attempts using the website's email infrastructure.
Technical details
The vulnerability is an email header injection flaw in the Send Email action component. The plugin accepts form field values and directly inserts them into email headers (CC, BCC, Reply-To) without validating or stripping carriage return and line feed (CRLF) characters. An unauthenticated attacker can submit a form with injected headers like "Bcc: attacker@evil.com" or "From: spoofed@domain.com" embedded in a form field, causing the email to be sent to unintended recipients or appear to come from a spoofed sender. Exploitation requires administrator configuration to source at least one message address (CC, BCC, or Reply-To) from a form field. The vulnerability was patched in version 3.6.5.2.
Affected products
- Crocoblock JetFormBuilder before 3.6.5.2
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 3.6.5.2