Unauthenticated Privilege Escalation in JetFormBuilder ≤ 3.6.2 Allows Admin Account Creation

Executive Summary

A critical unauthenticated privilege escalation vulnerability (CVE-2026-12793) has been disclosed in JetFormBuilder — Dynamic Blocks Form Builder, a popular WordPress form-building plugin from Crocoblock (jetmonsters). The flaw carries a CVSS score of 9.8 (Critical) and allows an attacker with no account on the target site to trigger the plugin's "Register User" post-submit action and create a new WordPress user — including an administrator, if a misconfigured form on the site is set up with an elevated default role.

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The root cause is that JetFormBuilder does not verify that a submitted form ID actually belongs to a published jet-form-builder custom post type before loading that referenced post's block content as the form schema and executing its configured post-submit actions — including the plugin's Advanced Validation server-side callback. By supplying a crafted form ID in an AJAX request, an attacker can coerce the plugin into parsing an arbitrary form definition and executing its wp_insert_user "Register User" action outside any authentication or capability check. The issue was reported through Wordfence's bug bounty program by researcher daroo. A fix landed in version 3.6.2.1, with additional server-side validation hardening added in 3.6.2.2 and further access-control/injection fixes in the 3.6.5.x line.

Vulnerability Overview

Affected Versions

Note: this is a distinct issue from the earlier CVE-2026-54196 ("Subscriber+ Privilege Escalation," CVSS 6.8, affecting versions ≤ 3.6.1), which required an authenticated low-privilege account. CVE-2026-12793 requires no authentication at all and is substantially more severe.

Attack Vector

1. Attacker identifies a WordPress site running JetFormBuilder ≤ 3.6.2
2. Attacker locates (or guesses) the post ID of any JetFormBuilder form on the
   site that has a "Register User" (wp_insert_user) post-submit action, or one
   configured with an elevated default role
3. Attacker sends a crafted, unauthenticated AJAX request referencing that
   form ID directly to the plugin's submission handler
4. The plugin fails to validate that the request's originating form context
   matches a genuine, published jet-form-builder form before parsing the
   referenced post's block content as the form schema
5. The plugin executes the form's configured Advanced Validation callback and
   post-submit "Register User" action without an auth/capability check
6. wp_insert_user() runs with attacker-supplied fields, creating a new
   WordPress account — administrator-level if the referenced form is
   misconfigured with an elevated role

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update JetFormBuilder to 3.6.2.1 or Later

# Via WP-CLI
wp plugin update jetformbuilder
 
# Verify the installed version
wp plugin get jetformbuilder --field=version

Or update through WordPress admin: Plugins > Installed Plugins > JetFormBuilder > Update Now. Because subsequent releases (3.6.2.2, and the 3.6.5.x line) shipped further server-side validation, access-control, and injection fixes, updating to the current release rather than the minimum fixed version is strongly recommended.

Step 2: Audit Forms With Privileged Post-Submit Actions

1. In the JetFormBuilder editor, review every form for a "Register User" post-submit action
2. Confirm the default role assigned to registered users is the lowest privilege necessary (never Administrator/Editor) for any public-facing form
3. Remove or disable Register User actions on forms that don't require self-registration

Step 3: Audit Recently Created User Accounts

# List recently created users, sorted by registration date
wp user list --fields=ID,user_login,user_email,user_registered,roles --orderby=registered --order=desc
 
# Flag any unexpected administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

If Immediate Patching Is Not Possible

1. Disable JetFormBuilder entirely until the update can be applied
2. Remove or unpublish any public form containing a "Register User" action
3. Block anonymous AJAX requests to the plugin's form-submission endpoints at the WAF/reverse-proxy level
4. Monitor access and error logs for anomalous POST requests referencing unfamiliar form IDs

Detection Indicators

Post-Remediation Steps

1. Confirm JetFormBuilder is updated to 3.6.2.1 or later (ideally the latest 3.6.5.x release)
2. Review all forms for privileged post-submit actions and tighten default roles
3. Audit user accounts for unauthorized administrators or unexpected registrations
4. Rotate credentials — WordPress admin passwords, database, and any API keys exposed to an attacker with admin access
5. Regenerate WordPress security keys using wp config shuffle-salts
6. Scan the installation for webshells or unauthorized plugin/theme modifications introduced by a rogue admin account
7. Deploy a WAF (Wordfence, Sucuri) for ongoing protection against form-abuse payloads
8. Enable file integrity monitoring to catch unauthorized plugin/theme changes

References

• NIST NVD — CVE-2026-12793
• Wordfence Threat Intelligence — JetFormBuilder Privilege Escalation
• WordPress Plugin Repository — JetFormBuilder fix changeset 3575346

Related Reading

• CVE-2026-9055: Amelia WordPress Plugin Privilege Escalation Vulnerability
• Privilege Escalation in User Registration & Membership ≤ 5.2.7
• Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1