{"id":"CVE-2025-11991","aliases":["EUVD-2025-203523","GHSA-8qf5-f8pm-p2rp"],"status":"published","title":"JetFormBuilder \u003c= 3.5.3 - Missing Authorization to Unauthenticated Form Generation","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00224,"percentile":0.13114,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-12-16T07:21:06Z","modified":"2026-10-07T19:10:00Z","products":[{"vendor":"jetmonsters","product":"jetformbuilder — dynamic blocks form builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c08444ef-77bc-4e9d-8d94-04b90cc99ded?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.2.1/modules/ai/rest-api/endpoints/generate-form-endpoint.php#L26"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11991"},{"url":"https://github.com/advisories/GHSA-8qf5-f8pm-p2rp"}],"sources":{"cve":[{"id":"CVE-2025-11991","title":"JetFormBuilder \u003c= 3.5.3 - Missing Authorization to Unauthenticated Form Generation","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.","status":"published","published":"2025-12-16T07:21:06.272Z","modified":"2026-04-08T17:19:38.755Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-203523","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.","status":"published","published":"2025-12-16T07:21:06Z","modified":"2026-04-08T17:19:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:42.318475Z"}],"ghsa":[{"id":"GHSA-8qf5-f8pm-p2rp","title":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to...","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.","status":"published","published":"2025-12-16T09:31:07Z","modified":"2025-12-16T09:31:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:05:12.969095Z"}],"nvd":[{"id":"CVE-2025-11991","description":"The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.","status":"published","published":"2025-12-16T08:15:50.65Z","modified":"2026-10-07T19:10:00.16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:50.400521Z"}]}}