Privilege Escalation in JetFormBuilder Plugin for WordPress

The JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress is affected by a critical privilege escalation vulnerability, assigned CVE-2026-12793. The vulnerability exists in versions up to and including 3.6.2. The security flaw stems from a lack of server-side validation concerning submitted form IDs. Specifically, the plugin fails to verify if a provided form ID is legitimate before parsing the referenced post's content as a form schema. This oversight enables the execution of an Advanced Validation server-side callback using attacker-controlled input. An unauthenticated attacker can exploit this mechanism to facilitate the creation of an administrative-level user account on the WordPress site. Given the plugin's functionality, this flaw represents a significant risk to site integrity and control.

Impact

Successful exploitation results in full administrative control over the affected WordPress instance. Attackers can create unauthorized administrator accounts, leading to complete site compromise, data exfiltration, and the deployment of further malicious persistence mechanisms. This vulnerability affects all WordPress installations utilizing the JetFormBuilder plugin version 3.6.2 or earlier.

Recommendation

• Upgrade the JetFormBuilder - Dynamic Blocks Form Builder plugin to the latest version immediately to remediate CVE-2026-12793.
• Audit existing WordPress user accounts for suspicious administrative privileges created after the discovery of this vulnerability.
• Restrict access to WordPress administrative endpoints and plugin configuration interfaces to authorized networks where possible.