Jetmonsters JetFormBuilder Plugin up to 3.6.2 on WordPress Update_Options do_action improper authorization

Summaryinfo

A vulnerability was found in Jetmonsters JetFormBuilder Plugin up to 3.6.2 and classified as problematic. This affects the function do_action of the component Update_Options. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-120561. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Jetmonsters JetFormBuilder Plugin up to 3.6.2 and classified as problematic. This vulnerability affects the function do_action of the component Update_Options. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect integrity. CVE summarizes:

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-120561 since 11/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/03/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• Jetmonsters

Name

• JetFormBuilder Plugin

Version

• 3.6.0
• 3.6.1
• 3.6.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion