CVE-2026-3279

Vulnerability

The Enable jQuery Migrate Helper plugin for WordPress, in all versions up to and including 1.4.1, contains a missing capability check in the downgrade_jquery_version() function. This function only verifies a nonce but does not check user capabilities, allowing any authenticated user to trigger the downgrade. The function is located in class-jquery-migrate-helper.php [1]. The plugin normally runs jQuery 3.7.1, but the downgrade switches the site-wide jQuery to the legacy 1.12.4-wp release.

Exploitation

An attacker needs only a valid WordPress account with Subscriber-level access or higher. The attacker can craft a request to the downgrade_jquery_version() function, passing the required nonce. Since no capability check is performed, the function will execute and update the _jquery_migrate_downgrade_version option to 'yes', effectively downgrading jQuery for all site visitors.

Impact

Successful exploitation forces the site to use jQuery 1.12.4-wp, a legacy version that contains known security vulnerabilities. This can expose the site to client-side attacks such as cross-site scripting (XSS) or other exploits targeting the outdated jQuery library. The attacker does not gain direct server-side access but weakens the site's security posture.

Mitigation

As of the publication date (2026-05-27), no patched version has been released. The vendor has not yet addressed the missing capability check. Users should restrict access to the plugin's functionality by ensuring only trusted administrators have accounts, or consider disabling the plugin until a fix is available. The plugin is not listed on the CISA KEV as of this writing.