{
 "id": "WPSEC-2026-2323",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2323/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2323/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2323/index.md",
 "title": "JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Attachment Deletion via Media Field",
 "description": "The JetFormBuilder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Media field in all versions up to, and including, 3.6.7.1, due to the field's JSON upload preset letting a submission reuse any existing attachment ID without checking who uploaded it, and the media cleanup ownership check allowing deletion of form-uploaded attachments with no recorded or only an inferred uploader by anyone who can edit the post that carries them. This makes it possible for authenticated attackers, with subscriber-level access and above, to place other visitors' form-uploaded attachments into a post they control through a form and then have those attachments deleted from the Media Library.",
 "plugin": {
  "slug": "jetformbuilder",
  "name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.6.3",
    "from_inclusive": true,
    "to": "3.6.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.6.3 before 3.6.8"
  ]
 },
 "introduced_in": "3.6.3",
 "fixed_in": "3.6.8",
 "remediation": "Update to 3.6.8 or later.",
 "fix_released": "2026-10-30T10:56:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:07.184374+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2323/",
  "https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/",
  "https://wordpress.org/plugins/jetformbuilder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}