A critical privilege escalation vulnerability in the JetFormBuilder WordPress plugin allows unauthenticated attackers to create administrator accounts, granting them full control over the affected site.

This flaw involves improper privilege management (CWE-269) where the plugin fails to validate submitted form IDs. An unauthenticated attacker can trigger an Advanced Validation server-side callback to execute unauthorized actions, specifically the creation of a new administrator-level user account.

The impact of this vulnerability is critical, as it provides an unauthenticated attacker with full administrative access to the WordPress environment. This level of compromise typically results in complete data theft, the ability to inject malicious code, and total loss of site availability. Given the CVSS score of 9.8, the risk to business operations and data integrity is extreme.

Immediate Action: Given that a specific fixed version is not explicitly stated in the provided metadata, administrators should immediately audit user accounts for unauthorized administrators and disable the plugin if an update to a version beyond 3.6.2 is not yet available from the vendor.

Proactive Monitoring: Review WordPress user management logs for the unexpected creation of new administrator accounts and monitor server-side callback activity related to the JetFormBuilder plugin for suspicious patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting form processing endpoints until a verified security patch is applied.

Public Exploit Available: Unknown.

This vulnerability represents an existential threat to any WordPress site running the affected JetFormBuilder plugin. Administrators must treat this as a high-priority incident, verify the integrity of their user database immediately, and ensure the plugin is updated to the latest available version as soon as the vendor releases a security patch.