blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-13439

CRITICAL 9.8 CVSS 3.1
Published
July 21, 2026
Last modified
July 21, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.

Affected WordPress components

  • Easy Form Builder by WhiteStudio – Drag & Drop Form Builder Plugin · easy-form-builder
    Confirmed match Active
    Up to and including 4.0.11
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • hassantafreshi Easy Form Builder by WhiteStudio – Drag & Drop Form Builder — Up to and including 4.0.11

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/class-Emsfb-public.php#L1587
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/class-Emsfb-public.php#L5024
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/class-Emsfb-public.php#L5060
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/class-Emsfb-public.php#L623
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/class-Emsfb-public.php#L96
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3588226/easy-form-builder/trunk/includes/class-Emsfb-public.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-form-builder/tags/4.0.11&new_path=%2Feasy-form-builder/tags/4.0.12
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/df8326b6-a443-4f76-a755-49f89af74d7e?source=cve
  • nvd.nist.gov Official NVD record