CVE-2026-3279: WordPress jQuery Helper Auth Bypass Flaw

CVE-2026-3279 Overview

CVE-2026-3279 is a missing authorization vulnerability in the Enable jQuery Migrate Helper plugin for WordPress. The flaw affects all versions up to and including 1.4.1. The downgrade_jquery_version() function verifies a nonce but fails to check user capabilities. Authenticated attackers with Subscriber-level access can downgrade the site-wide jQuery library from 3.7.1 to the legacy 1.12.4-wp release. The legacy jQuery version contains known security vulnerabilities, exposing the site to client-side attacks. The vulnerability is categorized as [CWE-862] Missing Authorization.

Critical Impact

Low-privileged authenticated users can force every visitor and administrator to load a jQuery version with known vulnerabilities, broadening the attack surface for cross-site scripting and prototype pollution exploits.

Affected Products

• Enable jQuery Migrate Helper plugin for WordPress, all versions through 1.4.1
• WordPress sites running the vulnerable plugin with Subscriber-level (or higher) registration enabled
• Any front-end or admin functionality that depends on the site-wide jQuery library

Discovery Timeline

• 2026-05-27 - CVE-2026-3279 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-3279

Vulnerability Analysis

The Enable jQuery Migrate Helper plugin exposes an administrative action that switches the bundled jQuery library between the current 3.7.1 release and the legacy 1.12.4-wp release. The handler implementing this switch, downgrade_jquery_version(), is intended to be restricted to administrators. Instead, it relies solely on a WordPress nonce for request validation. Nonces protect against cross-site request forgery but do not establish that the calling user holds the required role. Any authenticated user, including a Subscriber, can fetch a valid nonce from an accessible page and replay it against the action endpoint. The result is unauthorized modification of a persistent site option that governs the jQuery version delivered to every page load.

Root Cause

The root cause is a missing capability check inside downgrade_jquery_version(). The function does not invoke current_user_can() with a privileged capability such as manage_options before applying state changes. Source references at line 225 and line 256 of class-jquery-migrate-helper.php show nonce verification without an accompanying authorization gate. This violates the WordPress security model, which requires both nonce verification and capability checks for state-changing actions.

Attack Vector

An attacker registers or authenticates as a Subscriber on the target site. The attacker requests a page containing the plugin's nonce, then issues a crafted POST request invoking the downgrade action with the valid nonce. The plugin updates the stored jQuery preference to the legacy build. All subsequent visitors, including administrators, receive jQuery 1.12.4-wp with its known weaknesses. This enables follow-on exploitation of XSS sinks, dependency-based attacks, and prototype pollution issues that the current jQuery release has remediated.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Report and the WordPress plugin source at line 225 for the affected handler.

Detection Methods for CVE-2026-3279

Indicators of Compromise

• WordPress option storing the active jQuery version flipped to the legacy 1.12.4-wp release without a corresponding administrator session.
• Front-end pages serving /wp-includes/js/jquery/jquery.js resolved to the legacy migrate build after the plugin's downgrade action was invoked.
• Access log entries showing POST requests to the plugin's admin-ajax or admin-post endpoint originating from Subscriber accounts.

Detection Strategies

• Audit the WordPress options table for unexpected changes to the plugin's jQuery version setting and correlate the change time with authenticated session activity.
• Inspect class-jquery-migrate-helper.php to confirm whether the deployed version contains the missing capability check at lines 225 and 256.
• Monitor HTTP request bodies for the plugin's downgrade action name combined with referrers from non-admin pages.

Monitoring Recommendations

• Alert on authentication events where Subscriber-level accounts issue POST requests to WordPress administrative endpoints.
• Track integrity of jQuery assets served by the site and flag downgrades to versions older than 3.x.
• Review newly registered low-privilege user accounts followed by configuration-changing requests within a short window.

How to Mitigate CVE-2026-3279

Immediate Actions Required

• Update the Enable jQuery Migrate Helper plugin to a version later than 1.4.1 once a patched release is published by the vendor.
• Verify that the active jQuery version on the site is 3.7.1 and restore it if a downgrade has occurred.
• Disable open user registration or restrict it to vetted workflows until the plugin is patched.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Refer to the Wordfence Vulnerability Report and the plugin source repository for the latest remediation status. Apply the vendor patch as soon as it is published.

Workarounds

• Deactivate and remove the Enable jQuery Migrate Helper plugin if its functionality is not required.
• Apply a web application firewall rule that blocks POST requests to the plugin's downgrade action from non-administrator sessions.
• Use a custom must-use plugin to wrap the vulnerable handler with a current_user_can('manage_options') check until an official patch is applied.

# Configuration example - WP-CLI commands to audit and restore jQuery state
wp plugin list --name=enable-jquery-migrate-helper --fields=name,status,version
wp option get jquery_migrate_helper_settings
wp plugin deactivate enable-jquery-migrate-helper
wp user list --role=subscriber --fields=ID,user_login,user_registered