JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.4%
from disclosure to weapon0 days
Published on NVDSep 16
1st PoCSep 16
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builderpublic PoCs found — 3
githubgithub.com/murrez/CVE-2026-12793★ 5githubgithub.com/rootxn/CVE-2026-12793★ 0githubgithub.com/abraxas/CVE-2026-12793★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.