Unauthorized Data Modification in JetFormBuilder Plugin for WordPress
CVE-2026-120561

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Jetformbuilder — Dynamic Blocks Form Builder
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120561?

The JetFormBuilder plugin for WordPress is susceptible to unauthorized data modification due to inadequate capability checks in the 'do_action' function of the 'Update_Options' action class. This vulnerability affects all versions up to and including 3.6.2 and enables unauthenticated attackers to modify JetEngine Options Page values if the administrator has set up a form that utilizes the 'Update Options' feature. To leverage this vulnerability, both JetFormBuilder and JetEngine plugins must be installed and activated on the WordPress site, and specific configuration of the form must be in place.

Affected Version(s)

JetFormBuilder — Dynamic Blocks Form Builder 0 <= 3.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/jetformbuilder...
https://plugins.trac.wordpress.org/browser/jetformbuilder...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

andrea bocchetti
.