JetFormBuilder before version 3.6.5.2 fails to sanitize line breaks in email address fields taken from user‑submitted form data. This allows an unauthenticated user to insert arbitrary email headers, add hidden recipients, and forge the sender address. The weakness can be exploited by an attacker to send spam or phish emails that appear to come from legitimate users of the site.

The vulnerability affects the JetFormBuilder WordPress plugin for all releases older than 3.6.5.2. Any WordPress site that utilizes older versions of JetFormBuilder and has forms configured to use form fields as email recipients is susceptible.

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting the exploit probability is currently low. Nonetheless, the attack vector is straightforward: a remote visitor can submit a crafted form that injects newline characters into the recipient field, thereby creating additional email headers. If the site sends mail to recipients derived from user input, the attacker can proceed with spoofed sending and hidden forwarding.