abraxas/cve-2026-12793Proof-of-concept di exploit per CVE-2026-12793, un'escalation di privilegi non autenticata in WordPress JetFormBuilder fino alla versione 3.6.2 che crea account amministratore.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-12793
JetFormBuilder — Dynamic Blocks Form Builder 3.6.2 — jetmonsters
Il plugin JetFormBuilder — Dynamic Blocks Form Builder per WordPress è vulnerabile a Privilege Escalation in tutte le versioni fino alla 3.6.2 inclusa. Ciò è dovuto al fatto che il plugin non verifica che un ID modulo inviato appartenga a un modulo JetFormBuilder prima di analizzare il contenuto del post referenziato come schema del modulo ed eseguire un callback server-side di Advanced Validation. Questo rende possibile per attaccanti non autenticati creare un nuovo account utente con privilegi di amministratore.
| CVE | CVE-2026-12793 · CVE.org |
| CWE | CWE-269 |
| CVSS | Critical: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Prodotto | JetFormBuilder — Dynamic Blocks Form Builder |
| Affette | tutte le versioni fino alla 3.6.2 (inclusa) |
| Corrette | 3.6.2.1 e successive |
| Auth | nessuna (vedi source map) |
| Lab | solo 127.0.0.1 · pacchetto di disclosure per vendor/cliente, non uno scanner |
L'advisory nomina _jet_engine_booking_form_id e Advanced Validation. Quel campo POST è Form_Handler::$form_key. L'hook del router NON è il default del sorgente jet_form_builder_submit=submit; è la coppia randomizzata gfb_request_args_key/value. I nomi dei metodi PHP non sono action= HTTP. REST validate-field è la route sbagliata sulla 3.6.2 (validate_form_post_type viene già eseguito).
POST/GET /?rest_route=/wp/v2/posts&slug=jfb-lab-carrier -> id plus JFB_HOOK_KEY / JFB_HOOK_VAL (options-tab gfb_request_args_*)POST / REQUEST[hook_key]=hook_val method=ajax (NOT jet_form_builder_submit=submit)Form_Request_Router::listen (includes/request/request-router.php) uses Form_Handler::$hook_key/$hook_valForm_Handler::process_form -> setup_form -> set_form_id absint only (includes/form-handler.php:150-154, 183-200, 240)send_form: Action_Handler::set_form_id -> set_form_actions from _jf_actions of that post (includes/actions/action-handler.php:71-117)Request_Handler::set_form_data -> Block_Helper::get_blocks_by_post parse_blocks any post (includes/blocks/block-helper.php:186-201; includes/request/request-handler.php:30-33)block-parsers Module::init_request apply those blocks (modules/block-parsers/module.php:101-119)Default_Process_Event runs Register_User_Action::do_action wp_insert_user with settings.user_role (modules/actions-v2/register-user/register-user-action.php:66-215)Il POST JSON contiene status success e un user_id numerico. GET successivo /?rest_route=/wp/v2/users/<user_id> o una lista successiva che include login poc_12793 con role administrator. Il login univoco poc_12793 è il marker — non l'HTML hello-world.
Fai questo per primo: Aggiorna JetFormBuilder — Dynamic Blocks Form Builder a 3.6.2.1 o successiva.
Verifica dopo l'aggiornamento
CVE-2026-12793-Abraxas-Labs.py contro la build corretta: il witness mappato non deve apparire.Se non puoi aggiornare immediatamente
Target solo http://127.0.0.1:8088 (o il loopback su cui hai fatto il bind). Non puntare questo script verso internet.
python3 CVE-2026-12793-Abraxas-Labs.py
Il successo è il witness sopra nel body della risposta. Un generico 200 HTML non lo è.
www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve
Directory del plugin: jetformbuilder
Browser Trac: plugins.trac.wordpress.org/jetformbuilder
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-12793 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-12793`
- CWE: CWE-269
- published: 2026-09-16T04:17:56.110
## NVD description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
## MITRE description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
## Affected
- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder 0 affected
## References (JSON sources only)
- https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve
- https://github.com/advisories/GHSA-579w-q4cr-j8hc
- https://nvd.nist.gov/vuln/detail/CVE-2026-12793
## GitHub advisory
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege...
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
Questo pacchetto è per il vendor, il proprietario del sito e i lab autorizzati. Lo script comunica con 127.0.0.1. Usarlo contro sistemi di cui non sei proprietario non è autorizzato da Abraxas Labs. Nessuna garanzia.
SSR path (same schema): Server_Side_Rule::validate_custom call_user_func if the field rule value is a PHP function not in NOT_ALLOWED (modules/validation/advanced-rules/server-side-rule.php:187-194)