JetFormBuilder CVE-2026-120561

Exploitation requires a specific, non-default stack: BOTH the JetFormBuilder plugin (version ≤3.6.2) AND the JetEngine plugin must be installed and active, AND an administrator must have specifically built and published a form that uses the 'Update Options' post-submission action. Only forms wired to that action expose the vulnerable Update_Options code path, so sites without such a form are not exploitable even if both plugins are present. When those conditions are met, the attack needs no authentication and no user interaction (PR:N/UI:N). The principal limiting factor is therefore the administrator-created configuration dependency, not any attacker-side credential requirement; impact is confined to modifying JetEngine Options Page values (integrity only).

Signals point to a genuine but bounded medium-severity issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and PR:N confirms no authentication is required - consistent with abusing a public-facing form submission. However, the impact is deliberately narrow: only I:L (integrity), with C:N and A:N, so this modifies JetEngine Options Page values and does not by itself disclose data or crash the site, which is why the base score lands at 5.3 rather than critical. The exploitability is further gated by a specific deployment precondition (both JetFormBuilder and JetEngine active AND an administrator having configured a form that uses the 'Update Options' post-submission action), so it is not a universal drive-by against default installs. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the medium score. EPSS is NOT provided in the input and the vulnerability is NOT in CISA KEV, so exploitation probability cannot be quantified from this data. No SSVC automatable/technical-impact decision tree is supplied. Net: patch within the normal cycle this month; the unauthenticated network vector warrants attention, but the mandatory non-default configuration and integrity-only impact keep real-world priority moderate rather than critical.

On a WordPress site running both JetFormBuilder (≤3.6.2) and JetEngine where an administrator has published a form using the 'Update Options' post-submission action, a remote unauthenticated attacker submits a crafted request to that form. Because the capability check on the 'do_action' call in the Update_Options action class is missing, the request is accepted and the attacker alters JetEngine Options Page values. No public exploit identified at time of analysis; the referenced links are plugin source code and the fix changeset, not working exploit code.