Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-119480 EUVD-2026-114862GHSA-q397-gw93-chr5

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Published Nov 1, 2026 · Updated Nov 1, 2026 · Assigned by Patchstack

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Affected products

VendorProductAffectedFixed
Crocoblock JetFormBuilder ≤ 3.6.7.1 —

References