Answer in brief
CVE-2026-19860 records a Unknown severity vulnerability in JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback. The current sources do not mark it as known exploited. The current feed maps Unknown/JetFormBuilder — Dynamic Blocks Form Builder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/JetFormBuilder — Dynamic Blocks Form Builder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/JetFormBuilder — Dynamic Blocks Form Buildergeneric | >=3.5.6.2 <3.6.5.3 | 3.6.5.3 |
Published upstream
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 19, 2026
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
Quoted source text, attributed separately from HOL analysis.