Skip to content
Critical Privilege Escalation Vulnerability in JetFormBuilder Plugin

Critical Privilege Escalation Vulnerability in JetFormBuilder Plugin

First seen 17 Sep 2026, 04:54 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 17, 2026 at 05:57 UTC
  • •CVE-2026-12793 allows unauthenticated users to escalate privileges.
  • •Affected versions include all JetFormBuilder releases up to 3.6.2.
  • •Public proof-of-concept code is available, increasing exploitation risk.

The JetFormBuilder plugin for WordPress is vulnerable to a privilege escalation flaw (CVE-2026-12793) affecting all versions up to 3.6.2. The vulnerability allows unauthenticated attackers to create administrator-level accounts by exploiting improper validation of form IDs. Attackers can send crafted AJAX requests to trigger the 'Register User' action, leading to potential full site takeover if forms are misconfigured. A proof-of-concept exploit has been publicly released, raising the urgency for site administrators to secure their installations. The vulnerability was disclosed on September 16, 2026, and is currently unpatched. Users of the JetFormBuilder plugin are strongly advised to assess their configurations and apply necessary mitigations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-16
CVE-2026-12793 published
The vulnerability in JetFormBuilder was disclosed, allowing privilege escalation for unauthenticated users.
Sploitus
2026-09-16
Public PoC released
A proof-of-concept scanner and exploit for CVE-2026-12793 became publicly available, enabling exploitation.
Sploitus
2026-09-17
Exploit details published
Detailed technical analysis of the vulnerability and exploitation methods were published, emphasizing the risk.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2026-12793 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4