Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-4373 is a high-severity Absolute Path Traversal (CWE-36) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-4373 is a path traversal vulnerability (CWE-36) in the JetFormBuilder plugin for WordPress, affecting all versions up to and including 3.5.6.2. The issue stems from the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from Media Field preset JSON payloads without validating that the paths belong to the WordPress uploads directory. This is compounded by an insufficient same-file check in 'File_Tools::is_same_file', which only compares basenames, enabling arbitrary file reads.
Unauthenticated attackers can exploit the vulnerability by submitting a crafted form request to a JetFormBuilder form configured with a Media Field and a Send Email action that includes file attachments. Successful exploitation allows attackers to exfiltrate arbitrary local files from the server as email attachments. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network accessibility, low complexity, no privileges or user interaction required, and high confidentiality impact.
Patches addressing the vulnerability are available via changeset 3486996 in the JetFormBuilder plugin repository at https://plugins.trac.wordpress.org/changeset/3486996/jetformbuilder. Further details on the issue, including affected code locations in uploaded-file.php (line 99), send-email-action.php (line 214), and file-uploader.php (line 313), are provided in the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1?source=cve. Security practitioners should prioritize updating affected WordPress sites running vulnerable JetFormBuilder versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14240
Vulnerability Data
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload…
more
without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops construction of absolute paths from untrusted data before they reach file operations.
Enforced access authorizations can limit which resources are reachable even if a traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent absolute path traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect absolute path traversal via static analysis and fuzzing.
Secure development lifecycle includes input validation and path-handling requirements that reduce absolute path traversal risk.
Application security requirements typically mandate controls against path traversal in file-access functions.
Secure architecture principles call for canonicalization and sandboxing that limit absolute path traversal.
Secure coding standards directly require neutralization of absolute path sequences in pathname construction.
Information access restriction limits which files can be reached but does not address the path-construction flaw itself.