CVE-2026-12793
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in all versions up to and including 3.6.2 is vulnerable to Privilege Escalation. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This allows unauthenticated attackers to create a new administrator-level user account.
Risk Assessment
An attacker can create an administrator account without authentication, gaining full control over the WordPress site. This leads to possible backdoor installation, content modification, and data theft.
Recommendation
Update the JetFormBuilder plugin to a version later than 3.6.2 or disable it if no update is available. Monitor user accounts for unauthorized administrative accounts.
Other vulnerabilities in JetFormBuilder — Dynamic Blocks Form Builder
Original NVD description (English source)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS