Vulnerabilities / JetFormBuilder — Dynamic Blocks Form Builder / WPSEC-2026-2324
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Shortcode Execution via Submitted Field Macros
Medium 6.5
CWE-94Fixed in 3.6.8
- ID
- WPSEC-2026-2324
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- from 3.3.1 before 3.6.8
- Remediation
- Update to 3.6.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- JetFormBuilder — Dynamic Blocks Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via submitted field macros in all versions up to, and including, 3.6.7.1, due to submitted field values being substituted into Send Email, Call Webhook, Redirect To Page and Media field limit content through %field% macros before that content is passed to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a form field used by one of these settings.
References
- https://wpsec.com/vuln/WPSEC-2026-2324/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS