CVE-2026-19860 Overview
CVE-2026-19860 affects the JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin in versions before 3.6.5.3. The plugin permits administrators to configure PHP callbacks for custom field validation and enforces a blocklist that omits a file-deletion function. An authenticated user with form-management privileges can register a malicious validation callback. When any visitor submits the affected form, the server invokes the callback and deletes arbitrary files, without requiring authentication for the trigger step. The flaw is tracked under CWE-73: External Control of File Name or Path.
Critical Impact
Arbitrary file deletion on the WordPress host, executable by unauthenticated visitors once a privileged user has configured the callback, leading to site disruption and potential integrity loss.
Affected Products
- JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin
- Versions prior to 3.6.5.3
- WordPress installations exposing JetFormBuilder-managed forms to public submission
Discovery Timeline
- 2026-09-19 - CVE-2026-19860 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-19860
Vulnerability Analysis
JetFormBuilder allows form administrators to specify PHP functions as custom validation callbacks for form fields. The plugin gates this feature with a denylist of prohibited functions rather than an allowlist of safe ones. The denylist does not include a file-deletion function, so an administrator can nominate that function as a validator. Callback arguments derive from user-supplied field values, so submitting the form causes the server to call the file-deletion function against an attacker-controlled path. The submission endpoint is public, so no authentication is required to trigger the deletion once the form is configured.
Root Cause
The root cause is reliance on a denylist to restrict dangerous PHP callables. Denylists fail open whenever a sensitive function is missed, and the JetFormBuilder list omitted at least one filesystem-modifying function. The plugin also fails to sanitize the file path argument passed to the callback, permitting traversal outside the intended directory ([CWE-73]).
Attack Vector
Exploitation requires a two-stage flow. First, an actor with the ability to manage forms — either a compromised administrator account or an insider — configures a form field to use the file-deletion function as its validation callback and maps a form field to the target file path parameter. Second, any unauthenticated visitor submits the form. The plugin invokes the callback server-side, deleting the file at the supplied path. Attackers can target wp-config.php, plugin files, or .htaccess to disrupt the site, force re-installation, or trigger the WordPress setup wizard on subsequent visits.
See the WPScan Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-19860
Indicators of Compromise
- Unexpected deletion of WordPress core files, plugin files, or configuration files such as wp-config.php and .htaccess.
- JetFormBuilder form definitions in the database referencing filesystem functions in the validation_callback or equivalent metadata field.
- POST requests to JetFormBuilder submission endpoints (/wp-json/jet-form-builder/v1/* or admin-ajax.php?action=jet_form_builder*) followed by file-not-found errors in web server logs.
Detection Strategies
- Audit all JetFormBuilder forms for validation callbacks that reference PHP filesystem functions, including but not limited to unlink, rmdir, and wrapper equivalents.
- Correlate form submission events with filesystem change events on the WordPress document root and wp-content directory.
- Alert on any modification to wp_posts or wp_postmeta rows that store JetFormBuilder configuration when initiated by non-administrator sessions.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress installation directory and record baseline hashes for core, plugin, and theme files.
- Log all HTTP requests to JetFormBuilder REST and AJAX endpoints, including full POST bodies, for post-incident review.
- Monitor administrator authentication events and flag privilege changes preceding modifications to form validation configuration.
How to Mitigate CVE-2026-19860
Immediate Actions Required
- Update JetFormBuilder to version 3.6.5.3 or later on every WordPress site running the plugin.
- Review existing forms for validation callbacks that reference PHP filesystem functions and remove any that are not required.
- Rotate credentials for all WordPress accounts with form-management capabilities and enforce multi-factor authentication.
Patch Information
The JetFormBuilder maintainers addressed the issue in version 3.6.5.3 by tightening the callback restriction logic. Refer to the WPScan Vulnerability Report for advisory details and remediation confirmation.
Workarounds
- Restrict the manage_options and form-editing capabilities to a minimum set of trusted accounts until patching completes.
- Deploy a web application firewall rule that blocks POST requests to JetFormBuilder submission endpoints when form metadata contains suspicious callback names.
- Run the PHP-FPM worker under a user account with read-only access to WordPress core and plugin directories where operationally feasible.
# Configuration example: verify installed JetFormBuilder version via WP-CLI
wp plugin get jet-form-builder --field=version
# Update to patched release
wp plugin update jet-form-builder --version=3.6.5.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
