The JetFormBuilder plugin for WordPress allows an attacker to read any local file on the server. The vulnerability is caused by the set_from_array method accepting a file path from a Media Field preset JSON payload without verifying that the path resides in the uploads directory. When the form contains a Media Field and a Send Email action, a crafted request can be sent without authentication, causing the plugin to attach the requested file to an email and deliver it to the attacker. This path‑traversal flaw (CWE‑36) enables data exfiltration by reading arbitrary files, potentially exposing sensitive configuration, credentials, or application source code.

JetMonsters JetFormBuilder – Dynamic Blocks Form Builder for WordPress. All releases up to and including version 3.5.6.2 are vulnerable. WordPress sites running these plugin versions are at risk. Specifically, the plugin’s set_from_array in uploaded-file.php (line 99) and related file‑upload modules fail to validate the file path, allowing traversal outside the uploads directory.

The CVSS score of 7.5 indicates high impact. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, but the path‑traversal flaw combined with unauthenticated form submission means exploitation is straightforward once a form with the vulnerable configuration exists. An attacker who can submit a form to the site does not need authentication and can obtain any file the web server can read, making this a serious risk for sites that store sensitive files outside the uploads directory.