CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field

🗓️ 21 Mar 2026 06:45:13Reported by WordfenceType

CVE-2026-4373: JetFormBuilder <=3.5.6.2 allows unauthenticated arbitrary file read via media field and email attachments.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-4373	21 Mar 202606:45	–	attackerkb
Circl	CVE-2026-4373	21 Mar 202607:30	–	circl
CNNVD	WordPress plugin JetFormBuilder 安全漏洞	21 Mar 202600:00	–	cnnvd
CVE	CVE-2026-4373	21 Mar 202606:45	–	cve
EUVD	EUVD-2026-14240	21 Mar 202609:31	–	euvd
NVD	CVE-2026-4373	21 Mar 202607:16	–	nvd
Patchstack	WordPress JetFormBuilder plugin <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field vulnerability	24 Mar 202610:43	–	patchstack
Positive Technologies	PT-2026-26882	21 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4373	26 Mar 202614:58	–	redhatcve
Vulnrichment	CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field	21 Mar 202606:45	–	vulnrichment

[
  {
    "vendor": "jetmonsters",
    "product": "JetFormBuilder — Dynamic Blocks Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.5.6.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php
plugins	www.plugins.trac.wordpress.org/changeset/3486996/jetformbuilder
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php

08 Apr 2026 16:37Current

CVSS 3.17.5

EPSS0.00156

CWE-36