CVE-2026-12793

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to a critical unauthenticated privilege escalation flaw (CVSS 3.1: 9.8) in all versions up to and including 3.6.2. The plugin fails to verify that a submitted form ID actually corresponds to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. By submitting crafted form data that references an arbitrary post, an unauthenticated attacker can cause the callback to run and create a new administrator-level user account, effectively taking full control of the site. Any WordPress site running the plugin at version 3.6.2 or earlier is affected. No public PoC or known in-the-wild exploitation exists, and the issue is not in CISA's KEV catalog, but the unauthenticated, high-impact nature means defenders should treat it as urgently patchable.

What to do: Upgrade JetFormBuilder to a version newer than 3.6.2 (the latest available release) immediately; if no update is available yet, deactivate the plugin or use a firewall/WAF rule to restrict its form-submission endpoint. After patching, review the WordPress user list for any unexpected administrator accounts created recently and check access logs for anomalous form submissions from unauthenticated sources. If a rogue admin is found, remove the account, rotate all credentials and salts, and audit for malicious plugins, uploads, or modified theme files.