Junglewise Threat Intelligence

CVE-2026-3279: WordPress Enable jQuery Migrate Helper missing capability check

CVE-2026-3279 · Severity: medium · CVSS 6.5 · Published 2026-05-27

Vendors: Wordpress.

Executive brief

The Enable jQuery Migrate Helper plugin for WordPress, which helps maintain compatibility with older website scripts, contains a security flaw that allows low-level users to change site settings. An authenticated attacker with basic subscriber access can force the website to use an outdated and insecure version of the jQuery library. This could expose the website to further attacks and vulnerabilities associated with legacy software.

Technical details

The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to a missing authorization check (CWE-862) within the `downgrade_jquery_version()` function. While the function implements a nonce check for CSRF protection, it fails to verify if the requesting user has the necessary administrative capabilities. This allows an authenticated attacker with Subscriber-level permissions or higher to trigger a site-wide downgrade of the jQuery version from 3.7.1 to the legacy 1.12.4-wp release. Reverting to this legacy version introduces known security vulnerabilities into the site's front-end environment. The issue is present in all versions up to and including 1.4.1.

Affected products

  • WordPress Enable jQuery Migrate Helper Up to, and including, 1.4.1

Timeline

  • 2026-05-27: advisory: NVD published the CVE record based on Wordfence data.
  • 2026-05-27: disclosed: Vulnerability details made public.

References