The JetFormBuilder plugin for WordPress contains an unauthenticated path traversal vulnerability that could allow an attacker to read arbitrary files from the server filesystem.

The vulnerability exists in the Uploaded_File::set_from_array method, which fails to validate user-supplied file paths within Media Field JSON payloads. An unauthenticated attacker can exploit this by submitting a crafted form request, causing the plugin to attach arbitrary system files to email notifications.

Successful exploitation allows an unauthorized party to read sensitive configuration files, credentials, or system data stored on the web server. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality and may lead to full system compromise if sensitive environment variables or database credentials are exposed.

Immediate Action: Update the JetFormBuilder plugin to the latest version, ensuring it is beyond 3.5.6.2, where the path validation logic has been corrected.

Proactive Monitoring: Monitor web server logs for suspicious POST requests targeting the JetFormBuilder endpoints that contain unexpected file paths or traversal sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns in JSON payloads directed at the plugin functionality.

Public Exploit Available: Unknown

Organizations utilizing the JetFormBuilder plugin must prioritize this update to prevent unauthorized access to sensitive local files. Because the vulnerability is fully automatable and requires no authentication, the risk of automated scanning and exploitation is significant. Ensure all WordPress environments are patched immediately to secure the underlying server filesystem.