Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-19T07:16:32.417Z",
  "pubdate": "2026-09-19T07:16:32.417Z",
  "executiveSummary": "The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin, in versions prior to 3.6.5.3, contains a critical security vulnerability involving improper restriction of PHP functions used for custom field-validation callbacks.\nThe vulnerability is categorized as an Arbitrary File Deletion flaw. It originates from an insufficient blocklist mechanism that fails to sanitize or restrict dangerous PHP functions, specifically those capable of filesystem manipulation.\nThis vulnerability allows an unauthenticated remote attacker to trigger the deletion of arbitrary files on the underlying server. By leveraging the form submission process, an attacker can invoke the vulnerable callback mechanism to execute file-deletion operations with the privileges of the web server process.\nThe risk implication is severe, as it facilitates potential service disruption, site defacement, or the removal of critical system configuration files, such as wp-config.php, which could lead to full site compromise or total data loss.\nExploitation does not require prior authentication, making the attack surface publicly accessible. Organizations utilizing affected versions of the JetFormBuilder plugin are at immediate risk and should prioritize remediation.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the custom field-validation callback mechanism within the JetFormBuilder plugin. The plugin allows form creators to specify PHP functions to be executed during the form validation phase. To secure this implementation, the developers employed a blocklist approach intended to filter out dangerous or system-level PHP functions.\nThe security flaw stems from an incomplete blocklist that omitted critical filesystem-modifying functions, such as unlink(), from the restricted set. Because the validation logic relies on this inadequate filter, the application fails to prevent the execution of arbitrary file-deletion commands initiated via crafted form submissions.\nThe attack flow begins when an attacker identifies a form powered by an affected version of JetFormBuilder. The attacker crafts a request, typically via a form submission, that specifies a target file path on the server as an argument to the unblocked validation function. When the plugin processes the validation of the form fields, it executes the callback associated with the user input. Since the function is not blacklisted, the server executes the command against the provided file path, effectively deleting the file from the filesystem.\nThis vulnerability is particularly dangerous because the trigger mechanism is the form submission itself, which does not require the attacker to have administrative privileges or even be logged into the WordPress environment. The impact is dictated by the permissions of the web server user (typically www-data or similar). If the web server process has write access to the WordPress root directory, plugins folder, or sensitive configuration files, an attacker can perform destructive actions that render the site inoperable or prepare the environment for further exploitation.\nAffected versions are strictly limited to those before 3.6.5.3. The vulnerability demonstrates a failure in secure input handling and the inherent dangers of relying on blocklists for security controls. By permitting the execution of arbitrary functions during validation, the plugin creates a bridge between public user input and internal system operations, transforming a form builder into an unauthenticated remote execution vector for filesystem operations."
}