The Enable jQuery Migrate Helper plugin for WordPress fails to verify user capabilities when calling the downgrade_jquery_version() function. The only check performed is a nonce, allowing any authenticated user with at least Subscriber access to trigger the downgrade of the site‑wide jQuery library from 3.7.1 to the legacy 1.12.4‑wp release. The older release contains known security vulnerabilities that could be exploited once loaded on the site, effectively weakening site security without requiring additional privilege escalation.

The vulnerability is present in clorith:Enable jQuery Migrate Helper versions up to and including 1.4.1, which is distributed as a WordPress plugin. All WordPress sites that have this plugin installed and an authenticated user role of Subscriber or higher are potentially affected.

The issue carries a CVSS score of 6.5, indicating a moderate severity. Because the exploit requires only authentication as a Subscriber (a common role), the likelihood of exploitation is significant in environments where such users exist. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker would reach the vulnerable function through the plugin’s downgrade endpoint after providing a valid nonce; the lack of capability checks means the action can be performed by anyone with Subscriber access.