CVE-2026-120561
MediumCVSS 5.3Summary
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in versions up to and including 3.6.2 allows unauthorized data modification due to a missing capability check on the 'do_action' function in the 'Update_Options' action class. Unauthenticated attackers can modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires both JetFormBuilder and JetEngine to be installed and active and a form configured with the Update Options action.
Risk Assessment
An attacker could alter JetEngine option settings, potentially affecting site behavior and data integrity. The risk exists only in the specific form configuration.
Recommendation
Update the plugin to a version later than 3.6.2 as soon as it is available and review forms using the "Update Options" action. Until then, consider removing that action from forms.
Other vulnerabilities in JetFormBuilder WordPress plugin
See all- CVE-2026-92212Medium
The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.
- CVE-2026-19862Medium
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Original NVD description (English source)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS