Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Easy Form Builder by WhiteStudio <= 4.0.11 - Hackers can gain admin access

CVE-2026-13439 · published 2 months ago
Summary

The Easy Form Builder plugin for WordPress has a security weakness in versions up to 4.0.11. This means that hackers can gain full access to your WordPress site, including the ability to change passwords and make changes to your site's settings. To fix this, update the plugin to the latest version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hassantafreshi easy form builder by whitestudio – drag & drop form builder <= 4.0.11
Original advisory text
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password...
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-269Improper Privilege Management
Timeline
Published21 Jul 2026
Updated27 Sep 2026
First seen21 Jul 2026
Sources
CVE-2026-13439 · NVD
CVE-2026-13439 · MITRE
Track software like this
Free during beta