Vulnerabilities / JetFormBuilder — Dynamic Blocks Form Builder / WPSEC-2026-2325
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Event Execution via Render States
Medium 5.3
CWE-20Fixed in 3.6.8
- ID
- WPSEC-2026-2325
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- from 3.0.0 before 3.6.8
- Remediation
- Update to 3.6.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- JetFormBuilder — Dynamic Blocks Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary event execution via Conditional Block render states in all versions up to, and including, 3.6.7.1, due to render-state values taken from the submitted request being passed directly to the form event executor without being limited to registered render states. This makes it possible for unauthenticated attackers to trigger other registered form events, such as GATEWAY.SUCCESS, and run the actions bound to them, for example running post-payment actions without completing a payment.
References
- https://wpsec.com/vuln/WPSEC-2026-2325/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS