The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
| CVE | [CVE-2026-12793]( · [CVE.org]( |
| CWE | [CWE-269]( |
| CVSS | **Critical: 9.8** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Product | [JetFormBuilder — Dynamic Blocks Form Builder]( |
| Affected | all versions **through 3.6.2** (inclusive) |
| Lab | `127.0.0.1` only · vendor/client disclosure pack, not a scanner |
The advisory names _jet_engine_booking_form_id and Advanced Validation. That POST field is Form_Handler::$form_key. The router hook is NOT the source default jet_form_builder_submit=submit; it is the randomized gfb_request_args_key/value. PHP method names are not HTTP action=. REST validate-field is the wrong route on 3.6.2 (validate_form_post_type already runs).
- **Router:** Form_Request_Router listens for REQUEST[hook_key]=hook_val. Those are NOT the source defaults jet_form_builder_submit=submit — Form_Handler::set_jfb_request_args overwrites them from option jet_form_builder_settings__options-tab gfb_request_args_key / gfb_request_args_value (random 6+12 chars on first load). A POST that still sends jet_form_builder_submit=submit never matches; WP renders the theme HTML (~80k). Form id field is still _jet_engine_booking_form_id.
- **Notes:** CVE-2026-12793: set_form_id only absint()s. get_blocks_by_post parse_blocks() any post. Lab seed: published post slug jfb-lab-carrier (post_type=post, NOT jet-form-builder) with jet-forms fields + _jf_actions register_user administrator, and a paragraph JFB_HOOK_KEY=... JFB_HOOK_VAL=... so the randomized router pair is in the public REST body (same values a real form would put in hidden fields). Step 1 GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier (id + hook pair). Step 2 POST / with that pair, method=ajax, form id, login/email/password. Do not use REST validate-field (already type-checks in 3.6.2). Homepage HTML is FAIL.
- `GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier -> id plus JFB_HOOK_KEY / JFB_HOOK_VAL (options-tab gfb_request_args_*)`
- `POST / REQUEST[hook_key]=hook_val method=ajax (NOT jet_form_builder_submit=submit)`
- `Form_Request_Router::listen (includes/request/request-router.php) uses Form_Handler::$hook_key/$hook_val`
- `Form_Handler::process_form -> setup_form -> set_form_id absint only (includes/form-handler.php:150-154, 183-200, 240)`
- `send_form: Action_Handler::set_form_id -> set_form_actions from _jf_actions of that post (includes/actions/action-handler.php:71-117)`
- `Request_Handler::set_form_data -> Block_Helper::get_blocks_by_post parse_blocks any post (includes/blocks/block-helper.php:186-201; includes/request/request-handler.php:30-33)`
- `block-parsers Module::init_request apply those blocks (modules/block-parsers/module.php:101-119)`
- `Default_Process_Event runs Register_User_Action::do_action wp_insert_user with settings.user_role (modules/actions-v2/register-user/register-user-action.php:66-215)`
- `SSR path (same schema): Server_Side_Rule::validate_custom call_user_func if the field rule value is a PHP function not in NOT_ALLOWED (modules/validation/advanced-rules/server-side-rule.php:187-194)`
- WordPress with jetformbuilder 3.6.2 activated
- Lab seed published a regular post slug=jfb-lab-carrier (post_type=post, NOT jet-form-builder) with jet-forms/text-field blocks named login,email,password and _jf_actions register_user role administrator, _jf_args load_nonce=hide
- Discover id via GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier
POST JSON contains status success and a numeric user_id. Follow-up GET /?rest_route=/wp/v2/users/ or a later list that includes login poc_12793 with role administrator. Unique login poc_12793 is the marker — not hello-world HTML.
- POST / 200 with ~80k theme HTML (router miss: still sending jet_form_builder_submit=submit)
- Invalid form ID / Invalid security signature from /jet-form-builder/v1/validate-field
- status failed / nonce_failed / csrf_failed
- using a real jet-form-builder CPT id (that is intended behavior, not this CVE)
**Do this first:** Update **JetFormBuilder — Dynamic Blocks Form Builder** to **3.6.2.1 or newer**.
- Re-run `CVE-2026-12793-Abraxas-Labs.py` against the patched build: the mapped witness must **not** appear.
- Confirm the vendor advisory / changeset in the deployed tree (see references).
- Disable or isolate the affected component.
- Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).
Target **only** ` (or the loopback you bound). Do not point this script at the internet.
Success is the **witness** above in the response body. Generic 200 HTML is not it.
- [CVE-2026-12793 · NVD](
- [CVE-2026-12793 · CVE.org](
- [plugins.trac.wordpress.org/changeset/3575346/jetformbuilder](
- [
- [github.com/advisories/GHSA-579w-q4cr-j8hc](
- [nvd.nist.gov/vuln/detail/CVE-2026-12793](
- Plugin directory: [jetformbuilder](
- Trac browser: [plugins.trac.wordpress.org/jetformbuilder](
- SVN tags: [plugins.svn.wordpress.org/jetformbuilder](
- Abraxas Labs: [abraxaslabs.tech]( · [github.com/abraxas]( · [@abraxas_null](
- input: `
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder 0 affected
-
-
-
-
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege...
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
This pack is for **the vendor, the site owner, and licensed labs**. The script talks to `127.0.0.1`. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
