abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  CVE-2026-12793

CVE-2026-12793

JetFormBuilder — Dynamic Blocks Form Builder 3.6.2 — jetmonsters

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

Advisory (from the source map)

The advisory names _jet_engine_booking_form_id and Advanced Validation. That POST field is Form_Handler::$form_key. The router hook is NOT the source default jet_form_builder_submit=submit; it is the randomized gfb_request_args_key/value. PHP method names are not HTTP action=. REST validate-field is the wrong route on 3.6.2 (validate_form_post_type already runs).

Entry

• Method: POST
• Path: /
• Router: Form_Request_Router listens for REQUEST[hook_key]=hook_val. Those are NOT the source defaults jet_form_builder_submit=submit — Form_Handler::set_jfb_request_args overwrites them from option jet_form_builder_settings__options-tab gfb_request_args_key / gfb_request_args_value (random 6+12 chars on first load). A POST that still sends jet_form_builder_submit=submit never matches; WP renders the theme HTML (~80k). Form id field is still _jet_engine_booking_form_id.
• Notes: CVE-2026-12793: set_form_id only absint()s. get_blocks_by_post parse_blocks() any post. Lab seed: published post slug jfb-lab-carrier (post_type=post, NOT jet-form-builder) with jet-forms fields + _jf_actions register_user administrator, and a paragraph JFB_HOOK_KEY=... JFB_HOOK_VAL=... so the randomized router pair is in the public REST body (same values a real form would put in hidden fields). Step 1 GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier (id + hook pair). Step 2 POST / with that pair, method=ajax, form id, login/email/password. Do not use REST validate-field (already type-checks in 3.6.2). Homepage HTML is FAIL.

Call chain

• GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier -> id plus JFB_HOOK_KEY / JFB_HOOK_VAL (options-tab gfb_request_args_*)
• POST / REQUEST[hook_key]=hook_val method=ajax (NOT jet_form_builder_submit=submit)
• Form_Request_Router::listen (includes/request/request-router.php) uses Form_Handler::$hook_key/$hook_val
• Form_Handler::process_form -> setup_form -> set_form_id absint only (includes/form-handler.php:150-154, 183-200, 240)
• send_form: Action_Handler::set_form_id -> set_form_actions from _jf_actions of that post (includes/actions/action-handler.php:71-117)
• Request_Handler::set_form_data -> Block_Helper::get_blocks_by_post parse_blocks any post (includes/blocks/block-helper.php:186-201; includes/request/request-handler.php:30-33)
• block-parsers Module::init_request apply those blocks (modules/block-parsers/module.php:101-119)
• Default_Process_Event runs Register_User_Action::do_action wp_insert_user with settings.user_role (modules/actions-v2/register-user/register-user-action.php:66-215)

Lab preconditions

• WordPress with jetformbuilder 3.6.2 activated
• Lab seed published a regular post slug=jfb-lab-carrier (post_type=post, NOT jet-form-builder) with jet-forms/text-field blocks named login,email,password and _jf_actions register_user role administrator, _jf_args load_nonce=hide
• Discover id via GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier

Witness

POST JSON contains status success and a numeric user_id. Follow-up GET /?rest_route=/wp/v2/users/<user_id> or a later list that includes login poc_12793 with role administrator. Unique login poc_12793 is the marker — not hello-world HTML.

Not success

• generic 200 hello world HTML
• POST / 200 with ~80k theme HTML (router miss: still sending jet_form_builder_submit=submit)
• admin-ajax 400 body 0
• Invalid form ID / Invalid security signature from /jet-form-builder/v1/validate-field
• status failed / nonce_failed / csrf_failed
• creating a subscriber instead of administrator
• using a real jet-form-builder CPT id (that is intended behavior, not this CVE)

Patch / remediation

Do this first: Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.2.1 or newer.

Verify after upgrade

• Re-run CVE-2026-12793-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

python3 CVE-2026-12793-Abraxas-Labs.py

Success is the witness above in the response body. Generic 200 HTML is not it.

References

• CVE-2026-12793 · NVD

• CVE-2026-12793 · CVE.org

• plugins.trac.wordpress.org/changeset/3575346/jetformbuilder

• www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve

• github.com/advisories/GHSA-579w-q4cr-j8hc

• nvd.nist.gov/vuln/detail/CVE-2026-12793

• Plugin directory: jetformbuilder

• Trac browser: plugins.trac.wordpress.org/jetformbuilder

• SVN tags: plugins.svn.wordpress.org/jetformbuilder

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

# CVE-2026-12793  (structured records)

- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-12793`
- CWE: CWE-269
- published: 2026-09-16T04:17:56.110

## NVD description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

## MITRE description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

## Affected

- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder 0 affected

## References (JSON sources only)

- https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve
- https://github.com/advisories/GHSA-579w-q4cr-j8hc
- https://nvd.nist.gov/vuln/detail/CVE-2026-12793

## GitHub advisory

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege...

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null