How to Fix Recent WordPress Plugin Vulnerabilities Across JetFormBuilder, Better Messages, OpenStation, Customer Reviews, and Bookly

TL;DR: Update each affected plugin to the version that contains the official security fix. If you cannot update immediately, drop the short mu‑plugin patches shown in the sections below. Hard‑en your update pipeline – automate scans, pin versions, and keep a reliable staging copy so future bugs are caught early.

TL;DR Summary

• ✔️Update each affected plugin to the version that contains the official security fix.
• ✔️If you cannot update immediately, drop the short mu‑plugin patches shown in the sections below.
• ✔️Hard‑en your update pipeline – automate scans, pin versions, and keep a reliable staging copy so future bugs are caught early.

1. Quick Glossary

2. Why These Five Plugins Matter

All five plugins are high‑traffic, front‑facing components that sit on top of core WordPress functionality:

Because they touch user‑generated content, AJAX endpoints, and admin settings, a single flaw can give an attacker persistent access, data exfiltration, or financial loss (e.g., unwanted AI API calls).

3. Preparing Your Environment Before You Patch

1. Back up everything – database dump (wp db export) and file system (tar -czf wp-backup.tar.gz /var/www/html). Store the backup off‑site.
2. Spin up a staging copy – clone the live site to a sub‑domain (staging.example.com) or a local Docker container. Use the same PHP, MySQL/MariaDB, and web‑server configuration as production.
3. Enable WP_DEBUG in wp-config.php for the staging site:

define( 'WP_DEBUG', true );
   define( 'WP_DEBUG_LOG', true );
   define( 'SCRIPT_DEBUG', true );

1. Install an activity‑log plugin on both environments. It will record every updateoption(), wpinsertpost(), and wpajax_* call, giving you a forensic baseline.

4. JetFormBuilder – Stored XSS (CVE‑2026‑92212)

4.1 What Happened

JetFormBuilder stored form field labels ($fieldlabel) directly in the wpjfbformfields table. When the admin list view rendered each row, the code echoed the label without escaping:

echo '<td>' . $field_label . '</td>';

If a malicious user saved a label like , the script would be stored verbatim. Every admin who later opened the Forms → All Forms screen would trigger the alert, because the string was printed raw into the page’s HTML.

4.2 Why It Matters

• ✔️Persistence – The payload lives in the database, surviving plugin updates, theme changes, and even a full site migration.
• ✔️Privilege escalation – Only admins see the list, but many sites grant “editor” or “shop manager” roles the ability to edit forms. If those roles lack the unfiltered_html capability, the XSS still runs because the output occurs after WordPress’s core sanitisation.

4.3 Official Fix

• ✔️Version: JetFormBuilder 3.6.5.4 (released 2024‑08‑12).
• ✔️Change: All label output now passes through eschtml(). The plugin also adds a sanitizetext_field() call on save, preventing script tags from being persisted.
• ✔️Trade‑off – The official fix raises the minimum WordPress requirement to 5.9. If you run an older core version, you must either upgrade WordPress first or apply the mu‑plugin workaround.

4.4 Manual Fix (mu‑plugin)

Create a file wp-content/mu-plugins/jfb-xss-patch.php with the following content:

<?php
/**
 * Plugin Name: JetFormBuilder XSS Patch (pre‑upgrade)
 * Description: Escapes field labels in the admin list view to mitigate CVE‑2026‑92212.
 * Author: Your Name / Security Team
 * Version: 1.0
 */
add_action( 'admin_init', function () {
    // Bail out if JetFormBuilder is not active.
    if ( ! class_exists( 'Jet_Form_Builder' ) ) {
        return;
    }

    // Hook into the output buffer used by the plugin.
    // The original plugin uses a filter `jfb_form_fields_table_row`.
    add_filter( 'jfb_form_fields_table_row', function ( $html, $field ) {
        // $field['label'] is the raw DB value.
        $escaped = esc_html( $field['label'] );
        // Re‑build the <td> element.
        return '<td>' . $escaped . '</td>';
    }, 10, 2 );
} );

4.5 Cleaning Existing Entries

Run the following WP‑CLI command on the staging site (replace example.com with your domain):

wp search-replace '<script' '' --skip-columns=guid --url=https://example.com --dry-run

• ✔️Dry‑run first – verify the number of replacements.
• ✔️Remove the --dry-run flag once you are satisfied.

If you have multiple variants (.

5. Better Messages – SQL Injection (CVE‑2026‑93899)

5.1 What Happened

The plugin’s AJAX handler bmgetconversation() built a query like this:

$sql = "SELECT * FROM {$wpdb->prefix}bm_conversations WHERE id = $conversation_id";
$results = $wpdb->get_results( $sql );

No type casting, no $wpdb->prepare(). The conversationid parameter came directly from $GET['conversation_id'].

5.2 Why It Matters

• ✔️An attacker can inject arbitrary SQL – e.g., 1 UNION SELECT userlogin, userpass FROM wp_users--.
• ✔️The result set is returned as JSON, potentially exposing password hashes or other sensitive data.
• ✔️Even if the plugin later sanitises the output, the database engine already executed the malicious query.

5.3 Official Fix

• ✔️Version: Better Messages 3.0.5 (released 2024‑09‑02).
• ✔️Change: All public AJAX endpoints now use $wpdb->prepare() and cast numeric inputs with intval().
• ✔️Trade‑off – The fix adds a few extra milliseconds to each conversation fetch because of the extra preparation step. In high‑traffic chat rooms this can be noticeable, but the security gain outweighs the performance cost.

5.4 Manual Fix (mu‑plugin)

Create wp-content/mu-plugins/bm-sql-injection-patch.php:

<?php
/**
 * Plugin Name: Better Messages SQL Injection Patch (pre‑upgrade)
 * Description: Wraps the conversation query in $wpdb->prepare() and forces integer casting.
 */
add_action( 'wp_ajax_bm_get_conversation', 'bm_secure_conversation_query' );
add_action( 'wp_ajax_nopriv_bm_get_conversation', 'bm_secure_conversation_query' );

function bm_secure_conversation_query() {
    // Verify nonce first – the original plugin already does this, but we double‑check.
    check_ajax_referer( 'bm_conversation_nonce', 'nonce' );

    // Cast to integer to prevent injection.
    $conversation_id = isset( $_GET['conversation_id'] )
        ? intval( $_GET['conversation_id'] )
        : 0;

    if ( $conversation_id <= 0 ) {
        wp_send_json_error( [ 'message' => 'Invalid conversation ID' ] );
    }

    global $wpdb;
    $table = $wpdb->prefix . 'bm_conversations';
    $prepared_sql = $wpdb->prepare( "SELECT * FROM $table WHERE id = %d", $conversation_id );
    $results = $wpdb->get_results( $prepared_sql );

    if ( null === $results ) {
        wp_send_json_error( [ 'message' => 'Database error' ] );
    }

    wp_send_json_success( $results );
}

5.5 How to Test

1. Open the browser console on a logged‑in user page that loads Better Messages.
2. Run the following fetch command to test the endpoint:

fetch('/wp-admin/admin-ajax.php?action=bm_get_conversation&conversation_id=1 UNION SELECT user_login,user_pass FROM wp_users--&nonce=YOUR_NONCE')
     .then(r => r.text())
     .then(console.log);

1. Expected result – The server returns a 400 Bad Request JSON error (Invalid conversation ID), not a data dump.

6. OpenStation – Capability Bypass (CVE‑2026‑19775)

6.1 What Happened

OpenStation provides an AI‑feature toggle under Settings → OpenStation → AI. The settings page executed:

if ( isset( $_POST['openstation_ai_enabled'] ) ) {
    update_option( 'openstation_ai_enabled', $_POST['openstation_ai_enabled'] );
}

There was no currentusercan( 'manageoptions' ) check. Merely loading the page as any logged‑in user (including a subscriber) caused the $POST to be processed, because the form was submitted via JavaScript on page load.

6.2 Why It Matters

• ✔️Cost leakage – Turning the AI on triggers calls to OpenAI, Google Gemini, or other paid services. A malicious low‑privilege user could generate thousands of dollars in API usage.
• ✔️Data exposure – The AI may ingest site content (posts, comments) and send it to external endpoints, violating GDPR or HIPAA.

6.3 Official Fix

• ✔️Version: OpenStation 1.1.8 (released 2024‑07‑28).
• ✔️Change: Added a capability filter (preupdateoptionopenstationaienabled) that checks manageoptions. Also added a nonce verification on the settings form.
• ✔️Trade‑off – The new filter introduces a tiny overhead (a single currentusercan() call) on every request that touches the openstationaienabled option, which is negligible.

6.4 Manual Fix (mu‑plugin)

Create wp-content/mu-plugins/openstation-capability-patch.php:

<?php
/**
 * Plugin Name: OpenStation Capability Bypass Patch (pre‑upgrade)
 * Description: Prevents non‑admin users from toggling the AI feature.
 */
add_filter( 'pre_update_option_openstation_ai_enabled', function ( $new_value, $old_value, $option ) {
    // Only admins (manage_options) may change this option.
    if ( ! current_user_can( 'manage_options' ) ) {
        // Log the attempt for forensic purposes.
        if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) {
            error_log(
                sprintf(
                    '[OpenStation] Unauthorized AI toggle attempt by user %d',
                    get_current_user_id()
                )
            );
        }
        // Return the old value – the update is silently ignored.
        return $old_value;
    }
    // Allow the change for authorized users.
    return $new_value;
}, 10, 3 );

6.5 How to Test

1. Log in as a subscriber (or any role without manage_options).
2. Navigate to Settings → OpenStation → AI.
3. Toggle the switch and click “Save”.
4. Result – You should see a “You do not have permission to perform this action” message (the plugin may display a generic error). The option value in the database stays unchanged.

7. Customer Reviews for WooCommerce – Authorization Flaw (CVE‑2026‑89055)

7.1 What Happened

The AJAX endpoint ivolesavereviewmeta accepted a reviewid and a new rating value, then performed:

update_post_meta( $review_id, 'rating', $_POST['rating'] );

There was no verification that the current user owned the review.

7.2 Why It Matters

• ✔️A disgruntled shopper could downgrade a competitor’s product rating, influencing purchasing decisions.
• ✔️Manipulating reviews may violate consumer‑protection laws (e.g., FTC guidelines in the US).

7.3 Official Fix

• ✔️Version: Customer Reviews 5.120.1 (released 2024‑09‑15).
• ✔️Change: The handler now checks a nonce (ivolereviewnonce) and verifies that postauthor of the review matches getcurrentuserid().
• ✔️Trade‑off – Adding a nonce adds a tiny extra request (the nonce must be printed in the page markup). This is a negligible cost for the security gain.

7.4 Manual Fix (mu‑plugin)

Create wp-content/mu-plugins/customer-reviews-auth-patch.php:

<?php
/**
 * Plugin Name: Customer Reviews Authorization Patch (pre‑upgrade)
 * Description: Ensures only the review author can modify rating meta.
 */
add_action( 'wp_ajax_ivole_save_review_meta', 'ivole_verify_review_owner', 1 );

function ivole_verify_review_owner() {
    // Verify the nonce first – the original code may not have done this.
    if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'ivole_review_action' ) ) {
        wp_send_json_error( [ 'message' => 'Invalid nonce' ] );
    }

    $review_id = isset( $_POST['review_id'] ) ? absint( $_POST['review_id'] ) : 0;
    if ( ! $review_id ) {
        wp_send_json_error( [ 'message' => 'Missing review ID' ] );
    }

    $author_id = get_post_field( 'post_author', $review_id );
    $current_user = get_current_user_id();

    if ( $author_id !== $current_user ) {
        wp_send_json_error( [ 'message' => 'Permission denied' ] );
    }

    // If we reach this point, the original handler can safely run.
    // Let the original function continue (it is hooked later).
}

7.5 How to Test

1. Log in as Customer A and submit a review for Product X.
2. Log out, then log in as Customer B (different user ID).
3. Attempt to edit the review via the front‑end “Edit” button or by sending a crafted AJAX request.
4. Expected response – JSON: { "success": false, "data": { "message": "Permission denied" } }.

8. Bookly – File Write Injection (CVE‑2026‑93399)

8.1 What Happened

Bookly’s “Rollback Order” AJAX endpoint accepted a free‑form reason string and used it to construct a file path:

$path = WP_CONTENT_DIR . '/' . $reason . '.log';
file_put_contents( $path, $order_id );

Because $reason was not sanitized, an attacker could supply ../../wp-config.php and overwrite the core configuration file, gaining full site takeover.

8.2 Why It Matters

• ✔️Overwriting wp-config.php can inject malicious DB credentials or a backdoor.
• ✔️The altered config remains until manually fixed, providing persistence.

8.3 Official Fix

• ✔️Version: Bookly 28.3 (released 2024‑08‑05).
• ✔️Change: Whitelists allowed $reason values (rollback, debug) and runs sanitizefilename() before concatenation.
• ✔️Trade‑off – The whitelist restricts future custom reasons. If you need a new reason, extend the whitelist via a filter (booklyallowedrollback_reasons).

8.4 Manual Fix (mu‑plugin)

Create wp-content/mu-plugins/bookly-file-write-patch.php:

<?php
/**
 * Plugin Name: Bookly File Write Injection Patch (pre‑upgrade)
 * Description: Sanitises the 'reason' parameter and enforces a whitelist.
 */
add_action( 'wp_ajax_bookly_rollback_order', 'bookly_rollback_order_safe', 1 );

function bookly_rollback_order_safe() {
    // Verify nonce – Bookly already sends one, but we double‑check.
    check_ajax_referer( 'bookly_rollback_nonce', 'nonce' );

    $order_id = isset( $_POST['order_id'] ) ? absint( $_POST['order_id'] ) : 0;
    $reason   = isset( $_POST['reason'] ) ? sanitize_file_name( $_POST['reason'] ) : '';

    // Define the whitelist – you can extend via a filter later.
    $allowed = apply_filters(
        'bookly_allowed_rollback_reasons',
        [ 'rollback', 'debug' ]
    );

    if ( ! in_array( $reason, $allowed, true ) ) {
        wp_send_json_error( [ 'message' => 'Invalid reason' ] );
    }

    $path = WP_CONTENT_DIR . '/' . $reason . '.log';
    $result = file_put_contents( $path, $order_id, LOCK_EX );

    if ( false === $result ) {
        wp_send_json_error( [ 'message' => 'Unable to write log file' ] );
    }

    wp_send_json_success( [ 'message' => 'Rollback logged' ] );
}

8.5 How to Test

curl -X POST https://example.com/wp-admin/admin-ajax.php \
-d "action=bookly_rollback_order&order_id=123&reason=../../wp-config.php&nonce=VALID_NONCE"

• ✔️Expected – JSON response: { "success": false, "data": { "message": "Invalid reason" } }.
• ✔️Verify that no file named ../../wp-config.php.log exists in the root directory.

9. Applying Mu‑Plugins in Production – Practical Guidance

Trade‑offs of Using Mu‑Plugins

10. Full Patch‑Management Playbook

10.1 Pin Plugin Versions with Composer

If you manage WordPress via Composer (highly recommended for larger sites), add each plugin to composer.json with an exact version:

{
  "require": {
    "wpackagist-plugin/jetformbuilder": "3.6.5.4",
    "wpackagist-plugin/better-messages": "3.0.5",
    "wpackagist-plugin/openstation": "1.1.8",
    "wpackagist-plugin/customer-reviews-woocommerce": "5.120.1",
    "wpackagist-plugin/bookly-responsive-appointment-booking-tool": "28.3"
  },
  "extra": {
    "installer-paths": {
      "wp-content/plugins/{$name}/": ["type:wordpress-plugin"]
    }
  }
}

Apply community patches automatically with cweagans/composer-patches:

"cweagans/composer-patches": "^1.7",
"patches": {
  "wpackagist-plugin/jetformbuilder": {
    "XSS escape fix (pre‑upgrade)": "patches/jetformbuilder-xss.patch"
  }
}

Store the actual patch files in a patches/ directory under version control. When you run composer install or composer update, Composer will apply the patches before the plugin is activated.

10.2 Nightly WP‑CLI Update Cron

Add a cron entry on the server (as the web‑user) that runs every night at 02:30:

30 2 * * * /usr/bin/wp plugin update --all --minor --path=/var/www/html --allow-root >> /var/log/wp-cli-updates.log 2>&1

• ✔️--minor updates only patch releases, reducing the chance of breaking changes.
• ✔️The log file can be parsed by a monitoring tool (e.g., Logwatch) to alert you if an update fails.

10.3 Staging‑First Verification

After each nightly update, automatically spin up a temporary staging site using the wp-cli wp db export and wp db import commands:

# Create a copy of the DB

wp db export /tmp/staging.sql --path=/var/www/html

# Spin up a Docker container (example)

docker run -d --name wp-staging -p 8080:80 \
-e WORDPRESS_DB_HOST=db \
-e WORDPRESS_DB_USER=wp_user \
-e WORDPRESS_DB_PASSWORD=secret \
-e WORDPRESS_DB_NAME=wp_staging \
wordpress:php8.2-apache

# Import DB

docker exec -i wp-staging wp db import /tmp/staging.sql

# Run checksum verification

docker exec wp-staging wp core verify-checksums
docker exec wp-staging wp plugin verify-checksums

If any checksum fails, the script aborts and sends an email (mail -s "WP checksum failure").

10.4 Activity Logging & Alerting

• ✔️Install WP Activity Log or Simple History.
• ✔️Configure it to email the security team when the following events occur:
• ✔️optionupdate for openstationai_enabled by a non‑admin.
• ✔️plugin_update for any of the five vulnerable plugins (to catch accidental downgrades).
• ✔️file_modification in wp-content/mu-plugins (to detect tampering with your emergency patches).

10.5 Safe Rollback Procedure

If an update introduces a regression, roll back with WP‑CLI:

# Example: revert JetFormBuilder to the previous version

wp plugin install jetformbuilder --version=3.6.5.3 --force --activate --path=/var/www/html

• ✔️Never delete the plugin directory manually – let WP‑CLI handle the cleanup to avoid orphaned files.
• ✔️After rollback, run the checksum verification again to ensure no files were left behind.

11. Automating Security Scans in CI/CD

Example GitHub Actions Workflow

name: WordPress Security CI
on:
  push:
    branches: [ main, develop ]
  pull_request:
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: mbstring, intl, curl, zip
      - name: Install Composer dependencies
        run: composer install --prefer-dist --no-progress --no-suggest
      - name: Run PHPStan
        run: vendor/bin/phpstan analyse -c phpstan.neon --error-format=github
      - name: Run WPScan
        env:
          WPSCAN_TOKEN: ${{ secrets.WPSCAN_TOKEN }}
        run: |
          docker pull wpscanteam/wpscan
          docker run --rm -v $(pwd):/site wpscanteam/wpscan \
            --url https://staging.example.com \
            --api-token $WPSCAN_TOKEN \
            --format json \
            --output wpscan-report.json
      - name: Fail on critical CVEs
        run: |
          jq -e '.vulnerabilities[] | select(.cve == "CVE-2026-92212" or .cve == "CVE-2026-93899")' wpscan-report.json

The jq step will fail the job if any of the targeted CVEs are still present, enforcing a “no‑go‑live” rule until the patch is applied.

12. Post‑Patch Validation Checklist

After you have applied either the official update or the mu‑plugin workaround, run through this checklist on both staging and production:

1. Functional test – Verify the core feature of each plugin still works (e.g., submit a JetFormBuilder form, start a Better Messages chat, generate an OpenStation AI output).
2. Security test – Re‑run the same exploit attempts described in sections 4‑8. Confirm they now fail with a proper error.
3. Log review – Check wp-content/debug.log for any PHP Notice or Warning that could indicate a missing function or class.
4. Checksum verification – wp core verify-checksums and wp plugin verify-checksums. No mismatches should appear.
5. Performance baseline – Run ab -n 500 -c 20 External resource (or a similar load test) and compare response times before and after the patch. Document any increase > 5 % for later optimisation.

13. Long‑Term Maintenance Strategy

Example wp-config.php Hardening Flags

define( 'DISALLOW_FILE_EDIT', true );          // Prevents theme/plugin editor.
define( 'DISALLOW_FILE_MODS', true );          // Blocks plugin/theme install/updates via UI.
define( 'WP_AUTO_UPDATE_CORE', false );        // Force updates through CI only.
define( 'WP_DEBUG_DISPLAY', false );           // Never expose errors to visitors.

Note – When DISALLOWFILEMODS is true, you must rely on Composer/CLI for any future updates.

14. Key Takeaways

• ✔️Update now: JetFormBuilder ≥ 3.6.5.4, Better Messages ≥ 3.0.5, OpenStation ≥ 1.1.8, Customer Reviews ≥ 5.120.1, Bookly ≥ 28.3.
• ✔️Mu‑plugins provide a rapid, file‑system‑only stop‑gap when you cannot update within the 24‑hour window.
• ✔️Automate: Composer‑based version pinning, nightly WP‑CLI updates, CI‑driven WPScan and PHPStan scans.
• ✔️Three universal security rules – Escape output, Prepare SQL, Check capabilities.
• ✔️Static analysis + CI catches regressions before they reach production, turning “reactive patching” into “preventive hardening”.

15. Further Reading

• ✔️Securing WordPress REST API Endpoints – How to protect custom routes with nonces and permission callbacks.
• ✔️Managing Composer‑Based WordPress Deployments at Scale – Strategies for multi‑site fleets and zero‑downtime releases.
• ✔️Building a Zero‑Trust Architecture for Multi‑Site WordPress Networks – Network‑level segmentation, MFA, and least‑privilege IAM.

Read Next

• ✔️Mapster WP Maps vs Event Tickets: Which Authorization Bug Puts Your WordPress Site at Greater Risk
• ✔️How to Fix Critical WordPress Plugin CVEs Exposed in July 2026
• ✔️Apache InLong vs Confluent Kafka Connect: Which Survives Critical Vulnerabilities Better

Read next: continue with one of these related guides.