CVE-2026-13439
CRITICAL
CVSS 9.8
easy_form_builder_by_whitestudio_drag_drop_form_builder
Verified Advisory
Unauthenticated privilege escalation in Easy Form Builder for WordPress (CVE-2026-13439)
WordPress
Privilege Escalation
Wordpress Plugin
Easy Form Builder By Whitestudio Drag Drop Form Builder
The Easy Form Builder by WhiteStudio plugin for WordPress contains a flaw in its password recovery flow whereby the publicly-visible session identifier ('sid') is used as the password reset token. Combined with a publicly-accessible nonce refresh endpoint that issues valid WordPress REST nonces to unauthenticated visitors, this allows an unauthenticated attacker to reset the password of any WordPress user, including administrators, and gain full administrator access.
Affected versions:
- <= 4.0.11
We recommend updating to: 4.0.12.
CVSS 9.8 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/df8326b6-a443-4f76-a755-49f89af74d7e?source=cve
Details: https://vuln.today/cve/CVE-2026-13439
Verified by vuln.today against published advisories.
Affected versions
- – <= 4.0.11
Fixed in: 4.0.12