CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
CRITICAL 9.8EPSS 0.5%
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
- Affected
- jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.52% chance of exploitation in the next 30 days, 43rd percentile
- Published
- 2026-09-16
- Updated
- 2026-09-17
Proof-of-concept exploits (3)
- murrez/CVE-2026-127935★ · 2026-09-16
- rootxn/CVE-2026-127930★ · 2026-09-16
- abraxas/CVE-2026-127930★ · 2026-10-07