PT-2026-26882

🗓️ 21 Mar 2026 00:00:00Reported by Positive TechnologiesType

JetFormBuilder flaw allows arbitrary file read via path traversal in WordPress; weak checks enable unauthenticated exfiltration.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-4373	21 Mar 202606:45	–	attackerkb
Circl	CVE-2026-4373	21 Mar 202607:30	–	circl
CNNVD	WordPress plugin JetFormBuilder 安全漏洞	21 Mar 202600:00	–	cnnvd
CVE	CVE-2026-4373	21 Mar 202606:45	–	cve
Cvelist	CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field	21 Mar 202606:45	–	cvelist
EUVD	EUVD-2026-14240	21 Mar 202609:31	–	euvd
Fedora	[SECURITY] Fedora 44 Update: webkitgtk-2.52.5-1.fc44	12 Jul 202601:12	–	fedora
NVD	CVE-2026-4373	21 Mar 202607:16	–	nvd
Patchstack	WordPress JetFormBuilder plugin <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field vulnerability	24 Mar 202610:43	–	patchstack
RedhatCVE	CVE-2026-4373	26 Mar 202614:58	–	redhatcve

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php
twitter	www.twitter.com/VulmonFeeds/status/2035327909171265842
twitter	www.twitter.com/CVEnew/status/2035262082128490778
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4373
twitter	www.twitter.com/RedPacketSec/status/2035596699524026685
plugins	www.plugins.trac.wordpress.org/changeset/3486996/jetformbuilder
plugins	www.plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1
twitter	www.twitter.com/VolerionSec/status/2035255140249219407

22 Mar 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00397