The JetFormBuilder plugin for WordPress suffers from improper privilege management (CWE-269) that allows authenticated users with administrator-level permissions to escalate their privileges to super-admin on multi-site WordPress installations. This occurs due to insufficient restriction on user meta fields, enabling unauthorized privilege escalation. The vulnerability affects all versions up to and including 3.3.4.1. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows an authenticated administrator-level user to gain super-admin privileges on WordPress multi-site configurations. This could lead to full control over the entire multi-site network, including the ability to modify site settings, install or remove plugins, and access sensitive data across all sites in the network. The impact includes confidentiality, integrity, and availability compromise at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator-level access to trusted users only, and consider disabling or restricting the use of the JetFormBuilder plugin on multi-site WordPress installations. Monitor vendor communications for updates on patches or official mitigations.