Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-11991

JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jetmonsters JetFormBuilder — Dynamic Blocks Form Builder

Default version status: unaffected

  • 0 to ≤ 3.5.3affected

References