CVE-2026-3279
Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `downgrade_jquery_version()` function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which has knowns security vulnerabilities.
| CWE | CWE-862 |
| Vendor | clorith |
| Product | enable jquery migrate helper |
| Published | May 27, 2026 |
| Last Updated | May 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for clorith enable jquery migrate helper
Be the first to know when new medium vulnerabilities affecting clorith enable jquery migrate helper are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
clorith / Enable jQuery Migrate Helper
0 ≤ 1.4.1
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/1a74d5f4-1dd8-4d49-b4ce-8ba7ac9cbcc7?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/enable-jquery-migrate-helper/tags/1.4.1/class-jquery-migrate-helper.php#L225 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/enable-jquery-migrate-helper/tags/1.4.1/class-jquery-migrate-helper.php#L256 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/enable-jquery-migrate-helper/trunk/class-jquery-migrate-helper.php#L225 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/enable-jquery-migrate-helper/trunk/class-jquery-migrate-helper.php#L256
Credits
Chiao-Lin Yu