Description

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-06T10:17:13.577Z",
  "pubdate": "2026-09-06T10:17:13.577Z",
  "executiveSummary": "The JetFormBuilder WordPress plugin, in versions prior to 3.6.5.2, is susceptible to an unauthenticated shortcode injection vulnerability.\nThe vulnerability arises from improper input sanitization of a request parameter that is subsequently rendered as message content.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary shortcodes registered on the affected WordPress site.\nBy bypassing existing escaping mechanisms through a misaligned order of operations—specifically, applying escaping before the shortcode-expansion pass rather than after—the application fails to neutralize malicious shortcode tags.\nThe impact includes potential unauthorized execution of server-side functionality, sensitive data exposure, or other actions facilitated by existing shortcodes.\nImmediate updates to version 3.6.5.2 or later are required to mitigate this risk.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied input intended for rendering as message content within the JetFormBuilder plugin. The application fails to sanitize this input effectively, allowing malicious payloads to be injected into the system.\nThe exploitation mechanism relies on a flaw in the application's sanitization and rendering lifecycle. The plugin applies escaping to the input content prematurely, specifically before the shortcode-expansion pass occurs. Because the WordPress shortcode expansion process runs after the initial escaping, the escaping logic becomes ineffective at preventing the execution of arbitrary shortcodes.\nAn unauthenticated attacker can craft a malicious HTTP request containing a target shortcode. Upon processing, the plugin renders this input, and the WordPress engine subsequently parses the string for shortcode tags. Because the tags remain unneutralized due to the flawed processing order, the registered shortcode is executed within the context of the page rendering the form.\nThis vulnerability is classified as an injection flaw. The exploit requires no authentication or specific user privileges, as the vulnerable endpoint is accessible to unauthenticated users. The attack surface is broad, as the payload can be rendered on any page displaying a JetFormBuilder form.\nThe post-exploitation impact depends on the available shortcodes registered on the WordPress installation. An attacker can leverage this primitive to trigger unauthorized actions that the shortcode is designed to perform, which may include database modifications, retrieving private content, or interacting with other plugin functionalities, effectively elevating the attacker's impact from simple injection to arbitrary function execution."
}