CVE-2026-3279

Name of the Vulnerable Software and Affected Versions Enable jQuery Migrate Helper versions prior to 1.4.2

Description The plugin allows unauthorized modification of data because the downgrade jquery version() function fails to perform a capability check, verifying only a nonce. This allows authenticated users with Subscriber-level access or higher to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which contains known security flaws.

Recommendations Update the plugin to version 1.4.2 or later. As a temporary mitigation, restrict access to the downgrade jquery version() function for users with low-level privileges.