# JetFormBuilder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Preset Values

- **ID:** WPSEC-2026-2723
- **Plugin:** JetFormBuilder — Dynamic Blocks Form Builder (`jetformbuilder`), https://wordpress.org/plugins/jetformbuilder/
- **Affected versions:** all versions before 3.6.8.1
- **Fixed in:** 3.6.8.1 (Update to 3.6.8.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jetformbuilder
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2723/

## Description

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via dynamic preset values in all versions up to, and including, 3.6.8, due to dynamic preset results not being protected from shortcode parsing. This covers results drawn from sources visitors can control, such as query variables and post meta, and also preset JSON submitted as a field value when a rich content setting such as Send Email content or subject consists only of a field macro. These results were expanded as shortcodes in field labels, attributes, e-mails and redirects. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-2723/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8.1/
- https://wordpress.org/plugins/jetformbuilder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2723/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.