CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 Unauthenticated Privilege Escalation

September 25, 2026 · 417 views

Unauthenticated privilege escalation in the WordPress JetFormBuilder plugin (≤ 3.6.2) via the `_jet_engine_booking_form_id` handling path. Attackers may gain elevated capabilities without valid credentials.

#wordpress#jetformbuilder#privilege-escalation#unauthenticated

CVE:

CVE-2026-12793

Date:

2026-09-25

Severity:

CRITICAL

Exploit source

Full PoC repository on GitHub (public).

Description

Overview

CVE-2026-12793 affects JetFormBuilder for WordPress (reported ≤ 3.6.2). The flaw is described as unauthenticated privilege escalation tied to _jet_engine_booking_form_id processing in form/booking flows.

Impact

Privilege escalation on a WordPress site can lead to administrator access, theme/plugin installation, and full site compromise. Any internet-facing WordPress install with a vulnerable plugin version is at risk if the vulnerable endpoint is reachable.

Affected software

Plugin: JetFormBuilder (JetEngine ecosystem)
Reported ceiling: 3.6.2 and earlier
Fix: Upgrade to a vendor-patched release per WordPress plugin advisory

What the PoC does

The included Python script automates detection and proof-of-concept steps documented in community research. Run in check mode first on a staging clone; use exploit capabilities only with permission.

Legal and ethical use

Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.

References

Look up the CVE ID on NVD and the CVE Program for official records.
Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.