CVE-2026-12793: JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilder (Dynamic Blocks Form Builder)to a version that resolves this vulnerability.Fixed in 3.6.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated remote attacker can exploit it; no WordPress account or user interaction is required. Successful exploitation can create a new administrator-level account.
Which installations are affected?
JetFormBuilder versions up to and including 3.6.2 are affected. The issue is in the plugin’s handling of the _jet_engine_booking_form_id parameter when it parses referenced post content as a form schema.
What must an attacker provide to trigger the issue?
The attacker needs to submit a form ID through the _jet_engine_booking_form_id parameter that is not validated as belonging to a JetFormBuilder form. The referenced post content is then parsed and an Advanced Validation server-side callback is executed.