# JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Event Execution via Render States

- **ID:** WPSEC-2026-2325
- **Plugin:** JetFormBuilder — Dynamic Blocks Form Builder (`jetformbuilder`), https://wordpress.org/plugins/jetformbuilder/
- **Affected versions:** from 3.0.0 before 3.6.8
- **Fixed in:** 3.6.8 (Update to 3.6.8 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jetformbuilder
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2325/

## Description

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary event execution via Conditional Block render states in all versions up to, and including, 3.6.7.1, due to render-state values taken from the submitted request being passed directly to the form event executor without being limited to registered render states. This makes it possible for unauthenticated attackers to trigger other registered form events, such as GATEWAY.SUCCESS, and run the actions bound to them, for example running post-payment actions without completing a payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-2325/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/
- https://wordpress.org/plugins/jetformbuilder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2325/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.