Executive brief
JetFormBuilder is a WordPress plugin that allows users to create dynamic forms. An unauthenticated attacker can exploit a flaw in how the plugin processes form submissions to create a new administrator-level user account without proper authorization. This allows attackers to gain complete control of WordPress sites running vulnerable versions.
Technical details
The vulnerability is a privilege escalation flaw in JetFormBuilder versions up to and including 3.6.2. The plugin fails to validate that a submitted form ID actually belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. An unauthenticated attacker can exploit this by submitting a malicious form request that leverages the unvalidated form ID to trigger arbitrary form schema parsing and callback execution. This allows the attacker to create an administrator-level user account without authentication. The vulnerability is network-accessible and requires no user interaction beyond a single attacker-controlled request.
Affected products
- Crocoblock JetFormBuilder up to and including 3.6.2
Timeline
- 2026-09-16: disclosed