CVE-2026-12793
Received Received - Intake

Privilege Escalation in JetFormBuilder WordPress Plugin

Publication date: 2026-09-16

Last updated on: 2026-09-16

Assigner: Wordfence

Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-16
Last Modified
2026-09-16
Generated
2026-09-16
AI Q&A
2026-09-16
EPSS Evaluated
N/A
NVD
CVE-2026-12793
EUVD
EUVD-2026-80097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetformbuilder dynamic_blocks_form_builder to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The JetFormBuilder plugin for WordPress has a privilege escalation vulnerability in versions up to 3.6.2. It fails to validate if a submitted form ID belongs to a JetFormBuilder form before processing it. Attackers can exploit this to execute server-side callbacks and create an administrator-level user account without authentication.

Impact Analysis

An unauthenticated attacker could gain full administrative access to your WordPress site. This allows them to take control of your website, modify content, install malicious plugins, steal data, or disrupt operations. All WordPress sites using vulnerable versions are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, fines, and reputational damage due to non-compliance resulting from this security flaw.

Mitigation Strategies

Update the JetFormBuilder plugin to the latest version beyond 3.6.2 immediately to patch the privilege escalation flaw. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart