CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
Unauthenticated attackers can create administrator accounts by exploiting improper validation of form IDs in the JetFormBuilder WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12793?
CVE-2026-12793 is a critical vulnerability in jetmonsters JetFormBuilder — Dynamic Blocks Form Builder, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Weakness: CWE-269
Which versions are affected by CVE-2026-12793?
How do I fix CVE-2026-12793?
No fix has been published for CVE-2026-12793 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12793 being exploited?
There is no known exploitation of CVE-2026-12793 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-579w-q4cr-j8hc.