CVE-2026-19860— JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback
Quick assessment
Affected
Unknown JetFormBuilder — Dynamic Blocks Form Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
JetFormBuilder — 动态区块表单构建器 WordPress 插件在 3.6.5.3 版本之前，未能充分限制可作为自定义字段验证回调使用的 PHP 函数。该版本依赖一个黑名单机制，但该黑名单遗漏了一个文件删除函数，使得能够管理表单的用户可以触发服务器上的任意文件被删除。实际的删除操作在表单提交时执行，且无需身份验证。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback
Source: CVE Program / CVE List V5
Vulnerability Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | JetFormBuilder — Dynamic Blocks Form Builder | 3.5.6.2 ~ 3.6.5.3 | - |
|
II. Public POCs for CVE-2026-19860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19860
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-19860 (1)
-
🔗 JetFormBuilder 3.5.6.2 – 3.6.5.2 – Admin+ Arbitrary File Deletion via Server-Side Validation Callback | CVE 2026-19860 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-19 · 21 CVEs total
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | |
| CVE-2026-16557 | Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_con | |
| CVE-2026-84750 | Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-76554 | WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import | |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | |
| CVE-2026-85574 | Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unb | |
| CVE-2026-85680 | Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title | |
| CVE-2026-86591 | Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder R | |
| CVE-2026-86814 | UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider | |
| CVE-2026-92435 | Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API | |
| CVE-2026-92099 | WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squ | |
| CVE-2026-88824 | Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings | |
| CVE-2026-88926 | VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi | |
| CVE-2026-92404 | MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure | |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Sub | |
| CVE-2026-92430 | Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webh |
IV. Related Vulnerabilities
Same product: JetFormBuilder — Dynamic Blocks Form Builder
-
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalati -
CVE-2026-19861
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WY -
CVE-2026-19858
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and -
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthent -
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File R
Same vendor: Unknown
-
CVE-2026-92435
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken A -
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order St -
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modifica -
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Tak -
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Delet
V. Comments for CVE-2026-19860
No comments yet