CVE-2026-120561
Deferred Deferred - Pending Action

Unauthenticated Option Modification in JetFormBuilder WordPress Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120561

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetmonsters JetFormBuilder — Dynamic Blocks Form Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the JetFormBuilder plugin for WordPress allows unauthenticated attackers to modify JetEngine Options Page values due to a missing capability check. It requires both JetFormBuilder and JetEngine plugins to be active, and an administrator must have configured a form with the Update Options post-submission action.

Impact Analysis

An attacker could change settings in JetEngine Options Page, potentially altering website behavior or data. This could lead to unauthorized modifications of site configurations or stored data if an administrator has set up forms with the Update Options action.

Mitigation Strategies

Update the JetFormBuilder — Dynamic Blocks Form Builder plugin to the latest version, which addresses the missing capability check. If an update is not available, consider disabling the plugin or removing forms configured with the Update Options post-submission action until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...