Easy Form Builder <=4.0.11 Unauthenticated Privilege Escalation to Administrator via Password Recovery Endpoint (CVE-2026-13439)

Vulnerability Overview Vulnerability Name: Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint CVE ID: CVE-2026-13439 CVSS Score: 9.8 (Critical) Release Date: July 20, 2026 Last Updated: July 21, 2026 Researcher: CHOIOYONGMIN Affected Range Software Type: Plugin Software Slug: easy-form-builder Affected Versions: <= 4.0.11 Fixed Version: 4.0.12 Remediation Recommendation: Update to version 4.0.12 or later. Vulnerability Description The Easy Form Builder plugin by WhiteStudio contains an unauthenticated privilege escalation vulnerability in versions <= 4.0.11, allowing attackers to escalate regular users to administrators via the password recovery REST endpoint. This vulnerability arises because the password recovery process uses a publicly visible session identifier (sid) as the password reset token, combined with a publicly accessible nonce refresh endpoint. This allows any unauthenticated visitor to obtain a valid WordPress REST nonce. Attackers can gain full administrator access by extracting the public sid from a published login form page, then using the and endpoints to set any new password for a known sid. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Recently Discovered Vulnerabilities: - Easy Form Builder by WhiteStudio – Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection (CVE-2025-42747, CVSS 7.5, 2026-05-28) - Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure (CVE-2025-14067, CVSS 5.3, 2026-02-13) - Easy Form Builder <= 3.9.6 - Missing Authorization (CVE-2026-22472, CVSS 4.3, 2026-01-06) - Easy Form Builder <= 3.8.20 - Missing Authorization (CVE-2025-67577, CVSS 5.3, 2025-12-15) - Easy Form Builder <= 3.8.15 - Unauthenticated SQL Injection (CVE-2025-54678, CVSS 7.5, 2025-08-07) - Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVE-2024-12112, CVSS 6.4, 2025-01-07) - Easy Form Builder <= 3.7.4 - Authenticated (Contributor+) SQL Injection (CVE-2024-30535, CVSS 9.9, 2024-03-29) - Easy Form Builder <= 3.3.8 - Authenticated (Administrators) Stored Cross-Site Scripting (CVE-2022-3906, CVSS 5.5, 2022-11-16) Summary This is a critical unauthenticated privilege escalation vulnerability affecting multiple versions of the Easy Form Builder by WhiteStudio plugin. Users are advised to update to version 4.0.12 or later as soon as possible to mitigate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Easy Form Builder <=4.0.11 Unauthenticated Privilege Escalation to Administrator via Password Recovery Endpoint (CVE-2026-13439)

More from this source