Live › vulnerability › CVE-2026-120561
The JetFormBuilder plugin for WordPress lacks a capability check in its Update Options action, so unauthenticated visitors can change JetEngine Options Page values. The attack only works when an administrator has set up a form using the Update Options post-submission action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running WordPress with both JetFormBuilder and JetEngine active, where an administrator has built a form using the Update Options post-submission action. Sites without that combination or without that action configured are not exposed through this path. The sources do not state a fixed version.
No product ranges from the sources yet.
3.6.2 (Plugins screen in WordPress admin).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.
This page as .md · .json · in your agent: get_signal("CVE-2026-120561")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.