CVE-2026-13439 in Easy Form Builder Plugin
Summary
by MITRE • 07/21/2026
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The Easy Form Builder plugin for WordPress presents a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative control over affected installations. This vulnerability affects versions up to and including 4.0.11, making it a widespread concern for WordPress administrators who have not updated their installations. The flaw stems from a fundamental weakness in the plugin's password recovery implementation where session identifiers are exposed in a manner that undermines the security of the reset process.
The technical execution of this vulnerability relies on the exposure of publicly visible session identifiers within the plugin's login form interface. These session identifiers, referred to as 'sid', are stored in the wp_emsfb_temp_links database table and serve as password reset tokens. The vulnerability is compounded by the presence of a publicly accessible nonce refresh endpoint at Emsfb/v1/nonce/refresh that issues valid WordPress REST API nonces to unauthenticated visitors. This combination creates a pathway where attackers can harvest session identifiers from published login forms and utilize them in conjunction with the nonce endpoint to execute privileged actions without authentication.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables complete compromise of administrative accounts within targeted WordPress installations. Attackers can systematically target any known user email address through the Emsfb/v1/forms/message/add endpoint to initiate password recovery requests, then leverage the exposed sid token with the Emsfb/v1/forms/recovery/efb_set_password endpoint to set arbitrary passwords and assume full administrative privileges. This vulnerability directly violates security principle 2 from the OWASP Top Ten 2021, which addresses broken authentication mechanisms.
The exploitation chain demonstrates a clear pattern that aligns with attack techniques described in the MITRE ATT&CK framework under T1110 - Brute Force and T1566 - Phishing. The vulnerability creates an environment where attackers can perform automated credential manipulation without requiring any prior access or credentials. This weakness also relates to CWE-306 - Missing Authentication for Critical Function, as the password reset functionality lacks proper authentication checks before executing privileged operations.
Organizations affected by this vulnerability should immediately implement mitigations including disabling the plugin until a patched version is available, implementing rate limiting on the exposed endpoints, and monitoring for unauthorized access attempts. The WordPress community has established best practices for secure plugin development that emphasize proper session management, authentication verification, and protection of critical functions from unauthenticated access. Security professionals should also consider implementing network-based detection measures to identify attempts to access the vulnerable endpoints and monitor for unusual patterns in password reset activity.
This vulnerability exemplifies the importance of proper security testing during plugin development cycles and demonstrates how seemingly minor implementation flaws can create significant security risks. The exposed session identifiers and public nonce endpoints represent design flaws that should never be present in security-critical components of web applications. Organizations should also conduct regular security audits of their WordPress installations to identify similar vulnerabilities and ensure that all plugins maintain appropriate authentication mechanisms for privileged operations. The complexity of this attack vector highlights the need for comprehensive security monitoring and incident response procedures to detect and respond to such exploitation attempts effectively.