CVE-2026-120561

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder versions prior to 3.6.3

Description An issue exists where unauthenticated attackers can perform unauthorized modification of data. This occurs due to a missing capability check in the do action() function within the Update Options action class. The flaw allows the modification of JetEngine Options Page values if an administrator has configured a form with the Update Options post-submission action. This requires both JetFormBuilder and JetEngine to be installed and active.

Recommendations Update JetFormBuilder — Dynamic Blocks Form Builder to version 3.6.3 or later.