medium · CVSS v3 5.3

CVE-2026-120561

JetFormBuilder for WordPress is vulnerable to unauthorized modification of JetEngine Options Page values due to a missing capability check o

Overview

JetFormBuilder for WordPress is vulnerable to unauthorized modification of JetEngine Options Page values due to a missing capability check on the Update_Options action. Unauthenticated attackers can alter site configuration when an admin has enabled the Update Options post‑submission action. This flaw allows attackers to tamper with critical settings without logging in.

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.

Impact

The vulnerability compromises the integrity of site configuration, potentially leading to misconfigured forms, broken functionality, or unauthorized data exposure. Administrators and site owners are directly impacted as they may unknowingly allow attackers to change settings. Users may experience degraded service or incorrect form behavior.

Remediation

Upgrade JetFormBuilder and JetEngine to the latest versions (≥3.6.3). If an update is not possible, disable the Update Options action or restrict it to users with the 'manage_options' capability. Verify role permissions and monitor logs for unexpected changes. Apply any vendor patches as soon as they are released.

Risk context

The issue has a medium severity rating (CVSS 5.3) and no EPSS data is available. While it does not allow direct code execution, the ability to modify configuration can lead to significant operational impact. Defenders should treat it as a moderate risk that warrants timely patching.

Affected products

  • JetFormBuilder plugin
  • JetEngine plugin
  • WordPress

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

WordPress Plugin UnauthorizedModification JetFormBuilder JetEngine Configuration MediumSeverity

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120524

The News Kit Addons For Elementor plugin for WordPress is vulnerable to stored XSS via the formData parameter, allowing authenticated subscribers to inject arbitrary scripts. These scripts execute whenever a user views an affected page, enabling defacement or data theft. The flaw stems from insufficient sanitization and an operator-precedence bug that exposes the admin bundle to subscriber-level screens.

View analysis

medium

CVE-2026-120544

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

View analysis

medium

CVE-2026-120551

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

View analysis