JetFormBuilder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Preset Values
- ID
- WPSEC-2026-2723
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- all versions before 3.6.8.1
- Remediation
- Update to 3.6.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- JetFormBuilder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic preset values in all versions up to, and including, 3.6.8, due to dynamic preset results not being protected from shortcode parsing. This covers results drawn from sources visitors can control, such as query variables and post meta, and also preset JSON submitted as a field value when a rich content setting such as Send Email content or subject consists only of a field macro. These results were expanded as shortcodes in field labels, attributes, e-mails and redirects. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2723/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8.1/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS