JetFormBuilder CVE-2026-12793: Update Past 3.6.2 to Block Admin Account Creation
JetFormBuilder 3.6.2 and earlier are affected by CVE-2026-12793, a critical unauthenticated privilege-escalation vulnerability that can allow an attacker to create a WordPress administrator account. The CVE carries a CVSS 3.1 score of 9.8, with no authentication or user interaction required.
The affected range ends at 3.6.2. The first release outside that range is 3.6.2.1, and the WordPress.org changelog records security hardening in subsequent JetFormBuilder releases as well. Sites running JetFormBuilder should update to the current release available through WordPress so they receive the CVE fix and later security changes.
The vulnerability was disclosed by Wordfence on September 15, 2026. Wordfence's CVE record identifies the weakness as CWE-269: Improper Privilege Management and links the fix to the official WordPress plugin repository changeset.
CVE-2026-12793 at a glance
| Item | Detail |
|---|---|
| Product | JetFormBuilder — Dynamic Blocks Form Builder |
| CVE | CVE-2026-12793 |
| Severity | Critical |
| CVSS 3.1 | 9.8 |
| Affected versions | 3.6.2 and earlier |
| First version outside affected range | 3.6.2.1 |
| Attack vector | Network |
| Authentication required | None |
| User interaction | None |
| Impact | Creation of an administrator-level WordPress account |
| Weakness | CWE-269, Improper Privilege Management |
How the vulnerability reaches administrator privileges
JetFormBuilder processes forms submitted from the WordPress front end. According to the Wordfence CNA record, vulnerable releases fail to verify that a submitted form ID actually belongs to a JetFormBuilder form before parsing the referenced post content as a form schema.
An attacker can supply a crafted form reference through the _jet_engine_booking_form_id parameter. JetFormBuilder can then process an Advanced Validation server-side callback from content that should not have been accepted as the submitted form schema. Wordfence says this path can be used without authentication to create a new administrator-level account.
The resulting impact is direct WordPress administrative access. An administrator account can change site configuration, install or modify plugins and themes, create additional users, and access data available to WordPress administrators.
Which version should you install?
For CVE-2026-12793 specifically, the authoritative affected range is all versions through 3.6.2. That places 3.6.2.1 and later outside the CVE's affected range.
WordPress.org's official changelog also shows additional security work after 3.6.2.1. Version 3.6.2.2 added further server-side validation privilege-escalation hardening, while later 3.6.5.x releases include access-control, callback, injection and SQL-injection fixes.
The operational target should therefore be the latest JetFormBuilder release offered by the official WordPress update channel. This closes CVE-2026-12793 while also incorporating subsequent security fixes.
What administrators should check after updating
Updating closes the vulnerable code path. Sites exposed while running an affected version should also check for evidence of account creation or follow-on access.
- Record the installed version before updating. Sites on 3.6.2 or earlier were within the affected range.
- Update JetFormBuilder from the official WordPress plugin channel and confirm the installed version after the update.
- Review WordPress administrator accounts. Check for unfamiliar users, unexpected creation dates, changed email addresses or recently elevated roles.
- Review recent user-management activity and authentication logs where the hosting platform, security plugin or identity layer records them.
- Inspect plugin and theme changes made during the period in which the vulnerable version was exposed, especially unexpected installations or file modifications.
- Rotate credentials and sessions when compromise is suspected. Administrator passwords, application passwords, API credentials and active sessions may need replacement depending on what the unexpected account could access.
- Escalate confirmed compromise to incident response. Removing an unknown administrator alone is insufficient when that account may already have installed persistence or modified site files.
Exploitation evidence
Wordfence reports blocking attacks targeting this vulnerability. That telemetry establishes active attack traffic against the flaw, while the public CVE record defines the affected range and technical impact.
Attack-block counts can change rapidly and represent Wordfence's own network telemetry, separate from confirmed compromise counts. The observed attack traffic raises the priority of updating internet-facing sites and checking administrator accounts.
Related JetFormBuilder security fixes
JetFormBuilder has received several security-related changes around the same release sequence. The official WordPress.org changelog lists additional hardening for server-side validation and later fixes involving preset access, server-side callbacks, output escaping, email handling and SQL injection.
Those entries are separate from the precise affected-range statement for CVE-2026-12793. Administrators should use the current plugin release to pick up the broader security set; 3.6.2.1 is the minimum build outside this CVE's affected range.
Bottom line
CVE-2026-12793 has a straightforward remediation decision: JetFormBuilder 3.6.2 and earlier should be upgraded immediately to the current release. The vulnerability requires no account and can result in a new WordPress administrator account, giving it unusually high impact for an internet-facing form plugin.
After patching, review the administrator list and recent site changes. Unexplained administrator creation or other suspicious changes warrant a full WordPress compromise investigation, including persistence checks and credential rotation based on the affected site's exposure.
Sources
- Wordfence / CVE record for CVE-2026-12793, disclosed September 15, 2026.
- WordPress.org, JetFormBuilder plugin page and official changelog.
- WordPress Plugins Trac, JetFormBuilder changeset 3575346.
- Patchstack vulnerability database, independent affected-version and fixed-version corroboration.