{"id":"CVE-2026-119480","kind":"vulnerability","aliases":["CVE-2026-119480"],"related":[],"title":"JetFormBuilder: path traversal flaw affects versions through 3.6.7.1","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, has a path traversal flaw that lets a request reach files outside the intended directory. The sources do not say which files an attacker can read or write.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","package","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list or the plugin header.","fix":null,"status":"open","published_at":"2026-11-01T16:18:13+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","triaged_at":"2026-11-01T16:22:41+00:00","updated_at":"2026-11-01T16:22:41+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-01T16:22:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"JetFormBuilder: path traversal flaw affects versions through 3.6.7.1","impact":"medium","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, has a path traversal flaw that lets a request reach files outside the intended directory. The sources do not say which files an attacker can read or write.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown files readable or writable on the web server","analyst_note":"Check the NVD entry and the Crocoblock changelog for the fixed version and the exact vulnerable endpoint.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list or the plugin header.\n- unknown for any further check; the sources do not say which file paths or settings are involved.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"JetFormBuilder installations at version 3.6.7.1 or earlier are described as affected; the sources do not say which configuration or request path is needed. unknown for further detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":4127,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119480':11A,14A '-2026':10A,13A '3.6.7.1':8A,79C 'affect':5A,74C 'allow':70C 'attack':49B 'crocoblock':15B,25B,67C 'cve':9A,12A 'directori':40B,62C 'file':36B,47B 'flaw':4A,30B 'form':22B 'improp':54C 'intend':39B 'issu':73C 'jetformbuild':1A,16B,19B,68C,69C,75C 'let':32B 'limit':55C 'n/a':77C 'outsid':37B 'packag':17B 'path':2A,28B,63C,71C 'pathnam':58C 'plugin':23B 'reach':35B 'read':51B 'request':34B 'restrict':61C 'say':45B 'sourc':42B 'travers':3A,29B,64C 'traversal.this':72C 'version':6A 'vulner':65C 'wordpress':18B,21B 'write':53B","nicknames":[],"mitigations":[],"who_affected":"JetFormBuilder installations at version 3.6.7.1 or earlier are described as affected; the sources do not say which configuration or request path is needed. unknown for further detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T16:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119480","severity":null,"published_at":"2026-11-01T16:18:13+00:00","modified_at":"2026-11-01T16:18:13+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","fetched_at":"2026-11-01T16:20:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}