Security Alert Summary
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress contains a missing capability check in the run_callback function in all versions up to and including 3.5.3. This allows unauthenticated actors to trigger AI-based form generation, which can consume a site’s AI usage limits.
CVE Details
- CVE ID: CVE-2025-11991
- Affected component: JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress
- Affected versions: All versions up to, and including, 3.5.3
- Published: December 16, 2025 at 8:15 AM
- Last modified: December 16, 2025 at 2:10 PM
- CVSS v3.1: Base Score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User Interaction: No privileges required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE: CWE-862
Technical Details
The vulnerability is a missing capability check on the run_callback function, which is reachable in the AI form generation code paths. According to the provided references, the missing check appears in the AI REST API code handling form generation (see the referenced modules/ai/rest-api/endpoints/generate-form-endpoint.php entry).
Because the capability check is not enforced, unauthenticated requests can invoke the code path that generates forms via the plugin’s AI functionality. The immediate technical impact is unauthorized invocation of AI form generation routines, allowing an attacker to consume the site’s AI usage quota or billing allocation. The CVSS impacts indicate a low integrity impact (unauthorized modification of data) and no confidentiality or availability impact according to the entry.
How This Could Impact Your Website
Consider a site with multiple users: an owner who pays for AI usage, internal staff who manage content, and external contractors who contribute forms. An unauthenticated attacker could repeatedly trigger AI form generation, consuming the site’s AI quota or increasing API usage costs. This could lead to unexpected charges, reduced availability of AI resources for legitimate users, and potentially unauthorized changes to form content (integrity impact).
Generated or altered forms could be used to collect user input or to create convincing interfaces that increase the risk of targeted social engineering or phishing against your users. If you rely on a limited AI quota for business workflows, exhaustion of that quota could disrupt staff productivity.
professional review — If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Temporarily disable or restrict AI-related endpoints or features if possible until a fix is applied.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and lower-privileged accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual API usage patterns or repeated requests to AI endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
