JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Attachment Deletion via Media Field
- ID
- WPSEC-2026-2323
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- from 3.6.3 before 3.6.8
- Remediation
- Update to 3.6.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- JetFormBuilder — Dynamic Blocks Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Media field in all versions up to, and including, 3.6.7.1, due to the field's JSON upload preset letting a submission reuse any existing attachment ID without checking who uploaded it, and the media cleanup ownership check allowing deletion of form-uploaded attachments with no recorded or only an inferred uploader by anyone who can edit the post that carries them. This makes it possible for authenticated attackers, with subscriber-level access and above, to place other visitors' form-uploaded attachments into a post they control through a form and then have those attachments deleted from the Media Library.
References
- https://wpsec.com/vuln/WPSEC-2026-2323/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS