AIKIDO-2026-518725

TL;DR

set_form_id() takes _jet_engine_booking_form_id without checking that the ID is a published jet-form-builder post. The handler then parses that post's content as form schema and runs Advanced Validation server-side callbacks, which can invoke wp_insert_user. An unauthenticated attacker can point the parameter at attacker-controlled post content and create a new administrator. The fix accepts only valid JetFormBuilder form posts and blocks user-mutation callbacks in SSR validation.