JetFormBuilder <= 3.6.8 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover in Update User Action
- ID
- WPSEC-2026-2721
- Plugin
- JetFormBuilder — Dynamic Blocks Form Builder (jetformbuilder)
- Affected
- all versions before 3.6.8.1
- Remediation
- Update to 3.6.8.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-07
- Attack surface
- JetFormBuilder on WPSec AttackSurface
- Fix released
- Published
Description
The JetFormBuilder plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in the Update User form action in all versions up to, and including, 3.6.8 due to the action only checking the general 'edit_users' capability instead of the right to edit the specific target user. This makes it possible for authenticated attackers whose ability to edit users is restricted, such as WooCommerce Shop Managers, to modify accounts they are not allowed to edit, including administrators (for example changing their e-mail or password), when a form using the Update User action lets the target user be chosen.
References
- https://wpsec.com/vuln/WPSEC-2026-2721/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8.1/
- https://wordpress.org/plugins/jetformbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS