The JetFormBuilder – Dynamic Blocks Form Builder plugin for WordPress contains a missing capability check on the 'do_action' function in the 'Update_Options' action class. This flaw allows attackers who do not possess user credentials to alter JetEngine Options Page values when an administrator has configured a form with the Update Options post‑submission action. The vulnerability is a classic Unauthorized Access weakness, identified as CWE‑862, and can change site configuration and behavior, potentially enabling further compromise.

This issue affects WordPress sites that run JetFormBuilder versions up to and including 3.6.2 together with JetEngine. The vulnerability is only exploitable when an administrator has created a form that uses the Update Options action in a post‑submission scenario. No other versions or configurations are vulnerable.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available. The vulnerability is not currently listed in CISA's KEV catalog. Attackers can exploit the weakness by sending unauthenticated HTTP requests to the plugin's action handler that trigger the Update Options action, provided both plugins are active. The exploitation requires no additional privileges and could persist until the administrator updates or disables the offending form action.