Unauthorized Data Modification in JetFormBuilder Plugin for WordPress
CVE-2025-11991

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Jetformbuilder — Dynamic Blocks Form Builder
Vendor
CVE Published:
16 December 2025

What is CVE-2025-11991?

The JetFormBuilder plugin for WordPress has a vulnerability that allows for unauthorized modification of data. This is caused by a missing capability check in the run_callback function, which affects all versions up to and including 3.5.3. Exploiting this issue, unauthenticated attackers can generate forms using AI, leading to the potential exhaustion of the site's AI usage limits and impacting overall performance.

Affected Version(s)

JetFormBuilder — Dynamic Blocks Form Builder 0 <= 3.5.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/jetformbuilder...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tri Firdyanto
.