Vulnerability · Published Sep 19, 2026 · Assigned by WPScan

CVE-2026-19860JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback

Medium 5.5

In plain English

A medium-severity security flaw in JetFormBuilder — Dynamic Blocks Form Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

Affected products (as reported)

Vendor	Product	Versions
Unknown	JetFormBuilder — Dynamic Blocks Form Builder	3.5.6.2 – before 3.6.5.3

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

References

https://wpscan.com/vulnerability/d73d8d27-6dad-4a7f-bf51-f5fc18ebc81f/ exploit, vdb-entry, technical-description