JetFormBuilder permits e-mail header injection through submitted address fields
JetFormBuilder before 3.6.5.2 places address values sourced from submitted form fields into outgoing e-mail headers without validating or removing line breaks. On sites configured to take a message address from a form field, an unauthenticated submitter can inject additional headers, add hidden recipients, or spoof the sender.
- Component
- JetFormBuilder
- Plugin slug
jetformbuilder- Affected
- < 3.6.5.2
- Safe version
3.6.5.2- Published
- Sep 06, 2026
This CVE was published Sep 06, 2026 and is one of 25 known issues for this plugin.
Update, patch or deactivate.
Update JetFormBuilder to 3.6.5.2 or later and review affected forms and outbound mail for unauthorized headers or recipients. Until updated, do not source message addresses from visitor-controlled form fields.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N