The JetFormBuilder plugin for WordPress contains an absolute path traversal vulnerability (CWE-36) due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths without verifying that they reside within the WordPress uploads directory. Additionally, the 'File_Tools::is_same_file' method performs an insufficient check by comparing only basenames, enabling attackers to bypass protections. This flaw allows unauthenticated attackers to submit crafted form requests that cause arbitrary local files to be read and sent as email attachments if the form uses a Media Field and Send Email action with file attachment. The vulnerability affects all versions up to and including 3.5.6.2 and has a CVSS 3.1 score of 7.5 (high severity). No official patch or vendor advisory is provided in the data.

Successful exploitation permits unauthenticated attackers to read arbitrary files on the server and exfiltrate them via email attachments. This compromises confidentiality by exposing potentially sensitive local files. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring forms with Media Fields combined with Send Email actions that attach files. Restrict access to the affected plugin and monitor for suspicious form submissions. Do not rely on the current file path validation as it is insufficient.