EUVD-2026-46156
GHSA-3h5m-xwq3-mjmq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable REST endpoints with no user interaction and low complexity yield full administrator takeover, so PR:N/UI:N/AC:L and C/I/A all High.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user - including administrators - by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
Articles & Coverage 1
AnalysisAI
Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the site has a published/public page rendering an Easy Form Builder login or recovery form, because the attacker must scrape the publicly-visible 'sid' from that page's markup; it also requires knowing (or guessing) a valid target user's email address, such as an administrator's. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker browses to a public page that embeds an Easy Form Builder login form and scrapes the exposed session identifier ('sid') from the page markup. They then call the unauthenticated Emsfb/v1/nonce/refresh endpoint to obtain a valid WordPress REST nonce, submit a recovery request for a known administrator email via Emsfb/v1/forms/message/add, and finally invoke Emsfb/v1/forms/recovery/efb_set_password with the scraped sid to set an arbitrary new password - logging in as that administrator. … |
| Remediation | Vendor-released patch: update the Easy Form Builder plugin to version 4.0.12 or later, which is the fix confirmed by the WordPress.org changeset between tags 4.0.11 and 4.0.12 (fix committed in changeset 3588226 to class-Emsfb-public.php). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations for Easy Form Builder plugin presence and deactivate it immediately if found; document all deployments by version and hosting environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today