JetFormBuilder <= 3.6.5.4 - Unauthenticated Arbitrary Attachment Deletion via Media Field
- ID
- WPSEC-2026-0273
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- from 3.6.3 before 3.6.6
- Remediation
- Update to 3.6.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- JetFormBuilder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary Media Library attachment deletion in versions 3.6.3 to 3.6.5.4. When a submission carried no file, the Media field stored any attachment ID supplied in the request into post meta verbatim, and the 'delete removed attachments' cleanup introduced in 3.6.3 then permanently deleted (including the file on disk) every attachment ID that a later submission removed from that meta, without checking that the attachment was uploaded through a form, who uploaded it, or that the requester owned it. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments when a form uses the Insert/Update Post action to update an existing post, with a Media field that stores attachment IDs and has removed-attachment deletion enabled, and the attacker may update the target post (any post without an author, such as one created by a guest submission, or for authenticated attackers a post they authored).
References
- https://wpsec.com/vuln/WPSEC-2026-0273/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.6/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS