CVE-2026-120561mediumCWE-862

CVE-2026-120561: fallo de gravedad media en jetmonsters JetFormBuilder — Dynamic Blocks…

JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

Publicada el

Seguir esta CVE+ Monitorear JetFormBuilder — Dynamic Blocks Form Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
CVEs relacionadas — jetmonsters JetFormBuilder — Dynamic Blocks…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-13459MEDIUMJetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' ParameterEPSS 0.6%CVE-2024-7291HIGHJetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege EscalationEPSS 0.5%CVE-2026-12793CRITICALJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' ParameterEPSS 0.5%CVE-2026-4373HIGHJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media FieldEPSS 0.4%CVE-2026-92212MEDIUMJetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated FieldEPSS 0.3%CVE-2026-97342HIGHJetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post ActionEPSS 0.2%