A critical flaw in the Easy Form Builder by WhiteStudio plugin lets unauthenticated attackers reset any WordPress user's password, including administrators, and seize full control of affected sites.
What Is It
CVE-2026-13439 is an unauthenticated privilege escalation vulnerability (CWE-269) in the Easy Form Builder by WhiteStudio – Drag & Drop Form Builder plugin for WordPress. The plugin's password recovery flow uses the publicly-visible session identifier (sid) as the password reset token stored in wp_emsfb_temp_links. Combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that hands valid WordPress REST nonces to unauthenticated visitors, an attacker can chain the two weaknesses into a complete account takeover. It carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
The attack requires no authentication, no user interaction, and only low complexity over the network. An attacker scrapes the public sid from any published login form page, submits a recovery request for a known user email via Emsfb/v1/forms/message/add, then calls Emsfb/v1/forms/recovery/efb_set_password with that sid to set an arbitrary new password. The result is full administrator access to the WordPress site; enabling total compromise of content, users, and hosting.
What's Vulnerable
- Plugin: Easy Form Builder by WhiteStudio – Drag & Drop Form Builder for WordPress (vendor: hassantafreshi)
- Affected versions: All versions up to and including 4.0.11
Patch Status
The vendor references indicate the issue was addressed in version 4.0.12 (changeset comparing tags 4.0.11 → 4.0.12). Administrators running Easy Form Builder should update to 4.0.12 or later immediately. Note: this CVE is not currently listed in the CISA KEV catalog, and no confirmation of active exploitation was supplied.