Path Traversal Vulnerability in Crocoblock JetFormBuilder Plugin
CVE-2026-119480

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Jetformbuilder
Vendor
CVE Published:
1 November 2026

What is CVE-2026-119480?

The JetFormBuilder plugin by Crocoblock has a vulnerability that allows an attacker to improperly limit a pathname to a restricted directory. This path traversal issue poses significant risks, as it can enable unauthorized access to files stored on the server, potentially leading to arbitrary file deletion and further exploitation. Affected versions include JetFormBuilder prior to 3.6.7.1, underscoring the need for immediate action to secure WordPress installations using this plugin.

Affected Version(s)

JetFormBuilder 0 <= 3.6.7.1

References

https://patchstack.com/database/wordpress/plugin/jetformb...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nizar yart (D3dC0d) | Patchstack Bug Bounty Program
.