EUVD-2026-80097
GHSA-579w-q4cr-j8hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running JetFormBuilder ≤3.6.2
-
DeliverySend crafted unauthenticated form submission
-
ExploitSupply arbitrary post ID as form ID
-
ExecutionPlugin parses post content as form schema
-
PersistAdvanced Validation callback executes
-
ImpactCreate new administrator account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the JetFormBuilder WordPress plugin (versions ≤3.6.2). The only requirement is that the plugin is installed and active and that at least one form uses (or can reach) the Advanced Validation server-side callback path; the core flaw is missing validation that a submitted form ID actually belongs to a JetFormBuilder form. Limiting factors are minimal: no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). The practical limiter is simply whether the vulnerable plugin/version is deployed and whether a form with the affected validation feature exists on the site. |
| Impact | This is a genuine top-priority vulnerability, not an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is well-calibrated: the description confirms unauthenticated (PR:N) exploitation over the network that results in creation of a new administrator-level account, which cleanly justifies full C:H/I:H/A:H. The impact type (CWE-269 Privilege Escalation to admin) is directly corroborated by the description, so the vector and narrative agree with no conflict. No EPSS score, KEV listing, or SSVC decision data was supplied in the input, so exploitation-likelihood cannot be quantified from those frameworks; absence of KEV/EPSS is not evidence of low risk here. No public exploit was identified in the provided data. However, the risk profile is characteristic of Wordfence-reported WordPress plugin auth-bypass/privesc bugs, which are historically weaponized quickly once a patched changeset (here trac changeset 3575346) reveals the fix diff to attackers. Given pre-auth admin-account creation on a WordPress plugin, defenders should treat this as urgent and patch immediately regardless of the missing EPSS/KEV signals. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted JetFormBuilder form request supplying an arbitrary post ID as the form ID; because the plugin never verifies that the referenced post is actually a JetFormBuilder form, it parses attacker-influenced post content as a form schema and executes an Advanced Validation server-side callback. The attacker chains this to register a brand-new administrator-level user account, gaining full control of the WordPress site. No public exploit code was identified in the provided data, but the fix is visible in WordPress trac changeset 3575346, which can aid exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
RemediationAI
Upstream fix available (commit/changeset referenced); released patched version not independently confirmed. The referenced changeset 3575346 in the WordPress plugin Trac (https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder) indicates a fix has been committed, but the exact released version is not provided - update to the version containing that changeset (expected to be 3.6.3 or later) as soon as it is available. Until then, the most effective action is to deactivate and uninstall JetFormBuilder, which eliminates the vulnerable code path entirely; note this will remove all forms built with the plugin. If uninstalling is not feasible, restrict access to /wp-admin/admin-ajax.php and REST API endpoints to trusted IP addresses as a compensating control, but be aware this may break legitimate front-end form submissions for all users. Additionally, monitor for unauthorized administrator account creation and review existing user accounts for anomalies. Refer to the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29) for further details and any updated patch guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetFormBuilder is a WordPress plugin that provides dynamic block-based form building, including server-side validation callbacks. The vulnerability, classified as CWE-269 (Improper Privilege Management), arises because the plugin fails to verify that an attacker-supplied form ID corresponds to a legitimate JetFormBuilder form. An unauthenticated attacker can supply an arbitrary post ID; the plugin then parses that post's content as a form schema and triggers an Advanced Validation callback. By crafting the schema, the attacker can invoke functionality that creates a new WordPress user with administrator role. The issue affects the plugin's core input validation and authorization logic, allowing privilege escalation from zero privileges to full site control. The CPE string cpe:2.3:a:jetmonsters:jetformbuilder_-_dynamic_blocks_form_builder:* confirms the affected product family, with all versions up to and including 3.6.2 being vulnerable.
Know when Jetformbuilder Dynamic Blocks Form Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N) low-complexity network request lets an attacker create an admin account, yielding full confidentiality, integrity, and availability compromise of the site.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Executive ViewAI
The JetFormBuilder WordPress plugin, used by organizations to build dynamic forms, contains a critical flaw (CVE-2026-12793) in versions up to 3.6.2 that permits remote attackers to create administrator accounts, potentially leading to complete site takeover. This affects any entity hosting a vulnerable WordPress site, risking data theft, defacement, and regulatory penalties. Leadership should treat this as an urgent risk requiring immediate mitigation because exploitation could grant attackers full control over web assets and sensitive information.
Disable or uninstall the JetFormBuilder plugin; enforce WAF rules to block crafted requests targeting the vulnerable Advanced Validation callback; monitor for and promptly remove unauthorized administrator accounts; restrict administrative access and enable multi-factor authentication for all WordPress admin users; apply virtual patching if offered by a security vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthe
Arbitrary file deletion in the WordPress plugin JetFormBuilder - Dynamic Blocks Form Builder (versions 3.5.6.2 through b
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows u
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attack
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4
Reflected cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin (all versions up to
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthentic
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects al
Exploit-DB