Medium severity · published Dec 16, 2025
CVE-2025-11991
JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
JetFormBuilder — Dynamic Blocks Form Builder · jetmonsters
through 3.5.3 · source: vendor
Affected product
JD
JetFormBuilder — Dynamic Blocks Form Builder
jetmonsters
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11991
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11991
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.2.1/modules/ai/rest-api/endpoints/generate-form-endpoint.php#L26
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/c08444ef-77bc-4e9d-8d94-04b90cc99ded?source=cve
More from JetFormBuilder — Dynamic Blocks Form Builder
9.8
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
7.5
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
7.2
CVE-2026-97342
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
7.2
CVE-2024-7291
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
6.1
CVE-2026-92212
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field