Threats tagged 'ghsa-jj8w-9rh5-5798'

The JetFormBuilder plugin for WordPress, up to and including version 3.6.2, contains a vulnerability that allows unauthenticated attackers to modify JetEngine Options Page values. This occurs due to a missing capability check in the 'do_action' function within the 'Update_Options' action class. Exploitation requires that both JetFormBuilder and JetEngine plugins are installed and active, and that an administrator has configured a form with the 'Update Options' post-submission action.