{
 "id": "WPSEC-2026-0690",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0690/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0690/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0690/index.md",
 "title": "JetFormBuilder <= 3.6.6 - Unauthenticated Missing Authorization to Media Field Value Modification",
 "description": "The JetFormBuilder plugin for WordPress is vulnerable to Missing Authorization via the Media field in all versions up to, and including, 3.6.6, due to the field's 'user access' capability being checked only when a file is actually uploaded. A submission that carries a value but no file skips the check. This makes it possible for unauthenticated attackers, or users without the configured capability, to write values such as attachment URLs into the post properties and meta keys a restricted Media field is mapped to, on forms that use such a field with the Insert/Update Post action.",
 "plugin": {
  "slug": "jetformbuilder",
  "name": "JetFormBuilder",
  "full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.6.1",
 "remediation": "Update to 3.6.6.1 or later.",
 "fix_released": "2026-10-08T07:15:04+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:52:58.587942+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0690/",
  "https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.6.1/",
  "https://wordpress.org/plugins/jetformbuilder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-10"
 }
}