CVE-2026-12793

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.3

Description An issue exists where the plugin fails to validate if a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post content as form schema and executing an Advanced Validation server-side callback. This flaw allows unauthenticated attackers to perform privilege escalation by creating a new administrator-level user account.

Recommendations Update to a version newer than 3.6.2.