CVE-2026-12793— JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
Quick assessment
Affected
jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 JetFormBuilder — Dynamic Blocks Form Builder 在所有版本（包括 3.6.2 及更早版本）中存在权限提升漏洞。该漏洞源于插件在解析被引用帖子的内容并将其作为表单模式处理、以及执行高级验证服务器端回调之前，未验证提交的表单 ID 是否确实属于 JetFormBuilder 表单。这可能导致未认证的攻击者创建具有管理员级别权限的新用户账户。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12793
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jetmonsters | JetFormBuilder — Dynamic Blocks Form Builder | 0 ~ 3.6.2 | - |
|
II. Public POCs for CVE-2026-12793
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12793
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12793 (1)
IV. Related Vulnerabilities
Same product: JetFormBuilder — Dynamic Blocks Form Builder
-
CVE-2026-19861
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WY -
CVE-2026-19858
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and -
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthent -
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File R -
CVE-2025-11991
JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthent
Same vendor: jetmonsters
-
CVE-2026-90650
MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cr -
CVE-2026-73400
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Lo -
CVE-2026-28140
WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access C -
CVE-2026-9180
MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Ins -
CVE-2026-57347
WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Dat
Same weakness: CWE-269
-
CVE-2026-26947
Dell ECS 3.8.1.x及ObjectScale 4.4.0前权限提升漏洞 -
CVE-2026-88817
Privilege escalation via legacy access group creation endpoi -
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/co
V. Comments for CVE-2026-12793
No comments yet