A missing form-ownership check in JetFormBuilder; Dynamic Blocks Form Builder lets unauthenticated attackers create administrator accounts on affected WordPress sites, earning a CVSS 9.8 CRITICAL rating.
What Is It
JetFormBuilder does not validate that a submitted form ID actually belongs to a JetFormBuilder form. The plugin takes the referenced post ID, parses that post's content as a form schema, and executes the Advanced Validation server-side callback defined within it. Because the source post is never verified, an attacker can point the plugin at arbitrary content and drive execution of a callback path that provisions a new user; specifically, a new administrator-level account.
The flaw is classified as CWE-269 (Improper Privilege Management) and was reported by Wordfence.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction, with high impact across confidentiality, integrity, and availability. That combination means a remote, unauthenticated request is sufficient to reach full site compromise. Creating an administrator account is effectively total control of the WordPress installation: content, users, plugins, and any data the site handles.
There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the source material at this time.
What's Vulnerable
- Vendor: jetmonsters
- Product: JetFormBuilder; Dynamic Blocks Form Builder (WordPress plugin)
- Affected versions: all versions up to and including 3.6.2
No CPE entries were published alongside the record. The NVD entry was published 2026-09-16 and is currently in Received status, meaning NVD analysis is still pending.
Patch Status
A fix exists upstream. The WordPress plugin repository changeset 3575346 for jetformbuilder is referenced as the code change addressing this issue. Site operators running 3.6.2 or earlier should update to a release that includes that changeset.
No required-action deadline applies, as no KEV entry accompanies this CVE.
Sources
- NVD, CVE-2026-12793: https://nvd.nist.gov/vuln/detail/CVE-2026-12793
- WordPress Plugin Trac; jetformbuilder changeset 3575346: https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve