{"affected":[{"defaultStatus":"unaffected","product":"JetFormBuilder — Dynamic Blocks Form Builder","source":"CNA: Wordfence","vendor":"jetmonsters","versions":[{"lessThanOrEqual":"3.6.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120561","cwes":["CWE-862"],"description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the \"Update Options\" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793712101512,"publishedAt":1793680988797,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fe7d29-118f-42fb-9e48-6217faaa689b?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L50"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L50"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L75"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L75"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L82"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L82"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3575346/"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L50"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L75"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.12/compatibility/jet-engine/actions/update-options.php#L82"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L50"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L75"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/trunk/compatibility/jet-engine/actions/update-options.php#L82"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3575346/"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fe7d29-118f-42fb-9e48-6217faaa689b?source=cve"}],"remediation":[],"revision":"c1c16827c8898685334cbf36d0deebb20c81ffdd59e1eca2d0b389ac6bfad5c5","sources":[{"modifiedAt":1793712101512,"name":"CNA: Wordfence","retrievedAt":1793714973079,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120561"},{"modifiedAt":1793683113600,"name":"NVD","retrievedAt":1793686584560,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120561"}],"ssvc":{"assessedAt":1793712089529,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification","updatedAt":1793714973079}