CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 Unauthenticated Privilege Escalation
Unauthenticated privilege escalation in the WordPress JetFormBuilder plugin (≤ 3.6.2) via the `_jet_engine_booking_form_id` handling path. Attackers may gain elevated capabilities without valid credentials.
Description
Overview
CVE-2026-12793 affects JetFormBuilder for WordPress (reported ≤ 3.6.2). The flaw is described as unauthenticated privilege escalation tied to _jet_engine_booking_form_id processing in form/booking flows.
Impact
Privilege escalation on a WordPress site can lead to administrator access, theme/plugin installation, and full site compromise. Any internet-facing WordPress install with a vulnerable plugin version is at risk if the vulnerable endpoint is reachable.
Affected software
- Plugin: JetFormBuilder (JetEngine ecosystem)
- Reported ceiling: 3.6.2 and earlier
- Fix: Upgrade to a vendor-patched release per WordPress plugin advisory
What the PoC does
The included Python script automates detection and proof-of-concept steps documented in community research. Run in check mode first on a staging clone; use exploit capabilities only with permission.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.