What’s Vulnerable › Vulnerabilities
CVE-2026-19862: JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-06 · updated 2026-09-08
- Weakness: CWE-93
Description
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Affected products
- JetFormBuilder: before 3.6.5.2 — fixed in 3.6.5.2
How to fix
Upgrade to a fixed version: JetFormBuilder 3.6.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19862 or the next vulnerability affects your stack