JetFormBuilder validation callbacks can delete arbitrary files
A user able to manage forms configures a custom PHP validation callback. A blocklist omits a file-deletion function, allowing the configured callback to delete arbitrary server files when anyone submits the form. Configuration requires form-management access; only the trigger is unauthenticated. The export does not disclose the omitted function or callback-field name. Authoritative affected range: 3.5.6.2 to < 3.6.5.3. Confirmed remediation: 3.6.5.3.
- Component
- JetFormBuilder — Dynamic Blocks Form Builder
- Plugin slug
jetformbuilder-dynamic-blocks-form-builder- Affected
- 3.5.6.2 to < 3.6.5.3
- Safe version
3.6.5.3- Published
- Sep 19, 2026
This CVE was published Sep 19, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 3.6.5.3. Restrict form editing until updated and replace the callback blocklist with a small allowlist of side-effect-free validators. Remove unsafe callback configurations and restore deleted files from backups if necessary.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L