CVE-2026-4373

🗓️ 21 Mar 2026 06:45:13Reported by WordfenceType

Unauthenticated arbitrary file read via media field path traversal in JetFormBuilder up to 3.5.6.2.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-4373	21 Mar 202606:45	–	attackerkb
Circl	CVE-2026-4373	21 Mar 202607:30	–	circl
CNNVD	WordPress plugin JetFormBuilder 安全漏洞	21 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field	21 Mar 202606:45	–	cvelist
EUVD	EUVD-2026-14240	21 Mar 202609:31	–	euvd
Fedora	[SECURITY] Fedora 44 Update: webkitgtk-2.52.5-1.fc44	12 Jul 202601:12	–	fedora
NVD	CVE-2026-4373	21 Mar 202607:16	–	nvd
Patchstack	WordPress JetFormBuilder plugin <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field vulnerability	24 Mar 202610:43	–	patchstack
Positive Technologies	PT-2026-26882	21 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4373	26 Mar 202614:58	–	redhatcve

Vulners

Node

jetmonsters jetformbuilder_dynamic_blocks_form_builderRange≤3.5.6.2wordpress

[
  {
    "vendor": "jetmonsters",
    "product": "JetFormBuilder — Dynamic Blocks Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.5.6.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php
plugins	www.plugins.trac.wordpress.org/changeset/3486996/jetformbuilder
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php

17 Jun 2026 10:56Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00397

SSVC

CWE-36