https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:55:19.193431+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-282130 EUVD-2026-282130 2026-10-06T22:55:19.238512+00:00 EUVD-2026-282130 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4373 fkie_cve-2026-4373 2026-10-06T22:55:19.238547+00:00

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

 https://cve.radiocsirt.org/vuln/ghsa-947p-f7h4-wr4m GHSA-947p-f7h4-wr4m 2026-10-06T22:55:19.238582+00:00

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.