Arbitrary File Read Vulnerability in JetFormBuilder Plugin for WordPress

CVE-2026-4373

What is CVE-2026-4373?

The JetFormBuilder plugin for WordPress is affected by a vulnerability that allows arbitrary file read through path traversal. This issue stems from the 'Uploaded_File::set_from_array' method, which incorrectly accepts user-supplied file paths from the Media Field preset JSON payload without proper validation. An attacker can exploit this flaw by crafting a form request with a Media Field configured to send email attachments, enabling them to exfiltrate sensitive local files. The vulnerability is exacerbated by an inadequate same-file check in 'File_Tools::is_same_file', which only compares basenames, thus enabling unauthenticated attackers to gain access to unauthorized files.

References