{
 "id": "WPSEC-2026-2723",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2723/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2723/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2723/index.md",
 "title": "JetFormBuilder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Preset Values",
 "description": "The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic preset values in all versions up to, and including, 3.6.8, due to dynamic preset results not being protected from shortcode parsing. This covers results drawn from sources visitors can control, such as query variables and post meta, and also preset JSON submitted as a field value when a rich content setting such as Send Email content or subject consists only of a field macro. These results were expanded as shortcodes in field labels, attributes, e-mails and redirects. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site.",
 "plugin": {
  "slug": "jetformbuilder",
  "name": "JetFormBuilder",
  "full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.8.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.8.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.8.1",
 "remediation": "Update to 3.6.8.1 or later.",
 "fix_released": "2026-11-06T15:45:21+00:00",
 "published": "2026-11-07T16:41:22+00:00",
 "updated": "2026-11-07T11:11:15.918320+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2723/",
  "https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8.1/",
  "https://wordpress.org/plugins/jetformbuilder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-07"
 }
}