CVE-2026-19862
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
| Vendor | unknown |
| Product | jetformbuilder |
| Published | Sep 6, 2026 |
| Last Updated | Sep 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jetformbuilder
Be the first to know when new medium vulnerabilities affecting unknown jetformbuilder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / JetFormBuilder
0 < 3.6.5.2
References
Credits
Emirhan Kurt WPScan