CVE-2026-19860

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin versions prior to 3.6.5.3

Description Insufficient restriction of PHP functions used as custom field-validation callbacks allows users with form management privileges to trigger the deletion of arbitrary files on the server. This occurs because the plugin uses a blocklist that fails to include a specific file-deletion function. The actual file deletion is triggered upon form submission, a process that requires no authentication.

Recommendations Update JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin to version 3.6.5.3 or later.