What is the CVSS score of CVE-2026-13439?

CVE-2026-13439 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-13439?

Within 24 hours: audit all WordPress installations for Easy Form Builder plugin presence and deactivate it immediately if found; document all deployments by version and hosting environment. Within 7 days: implement Web Application Firewall (WAF) rules to block requests to the plugin's password recovery and nonce endpoints for all external traffic; enable real-time logging and alerting on admin password reset attempts and account modifications. Within 30 days: migrate all forms to an alternative form builder solution with demonstrated secure password recovery; remove Easy Form Builder entirely from all environments and verify no plugin artifacts remain.

Easy Form Builder CVE-2026-13439

EUVD-2026-46156 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 Wordfence

GHSA-3h5m-xwq3-mjmq

WordPress Privilege Escalation Wordpress Plugin Easy Form Builder By Whitestudio Drag Drop Form Builder

9.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Scrape public sid from login form page
Delivery

Call Emsfb/v1/nonce/refresh for valid REST nonce
Exploit

Submit recovery request for admin email via forms/message/add
Execution

Call recovery/efb_set_password with sid to set new password
Impact

Log in as administrator with full control

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the site has a published/public page rendering an Easy Form Builder login or recovery form, because the attacker must scrape the publicly-visible 'sid' from that page's markup; it also requires knowing (or guessing) a valid target user's email address, such as an administrator's. Given those, no authentication, no privileges, and no user interaction are needed (CVSS PR:N/UI:N) - the Emsfb/v1/nonce/refresh endpoint supplies valid nonces to any unauthenticated visitor, and the recovery/set-password endpoints accept the public sid as the reset token. The main limiting factor is deployment: a site running the plugin without any publicly exposed form (so no scrapeable sid) or on a version at/after 4.0.12 is not exploitable via this path. Affected versions: up to and including 4.0.11.
Impact	This is a genuine high-priority issue, not an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is fully consistent with the described attack: network-reachable, no authentication, no user interaction, low complexity, and total compromise of the target account leading to administrator access. All three signals that would normally require special conditions - a secret reset token, a valid nonce, and authentication - are removed by design flaws, so the exploitation barrier is essentially the attacker knowing a target email. No EPSS score, SSVC decision, KEV entry, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis', which tempers immediate in-the-wild urgency but does not lower the intrinsic risk given how mechanically simple the chain is. No conflicting signals were found between the CVSS vector and the description - both agree on unauthenticated network exploitation.
Exploit ScenarioDerived	An attacker browses to a public page that embeds an Easy Form Builder login form and scrapes the exposed session identifier ('sid') from the page markup. They then call the unauthenticated Emsfb/v1/nonce/refresh endpoint to obtain a valid WordPress REST nonce, submit a recovery request for a known administrator email via Emsfb/v1/forms/message/add, and finally invoke Emsfb/v1/forms/recovery/efb_set_password with the scraped sid to set an arbitrary new password - logging in as that administrator. No public POC is referenced, but every step is fully documented in the CVE description.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.

RemediationAI

Vendor-released patch: update the Easy Form Builder plugin to version 4.0.12 or later, which is the fix confirmed by the WordPress.org changeset between tags 4.0.11 and 4.0.12 (fix committed in changeset 3588226 to class-Emsfb-public.php). This is the primary and only complete remediation. If immediate patching is not possible, remove or deactivate the plugin, since the flaw is inherent to its recovery flow; as interim compensating controls, block or restrict unauthenticated access to the plugin's REST routes at the web/WAF layer - specifically Emsfb/v1/nonce/refresh, Emsfb/v1/forms/message/add, and Emsfb/v1/forms/recovery/efb_set_password - and unpublish or restrict any public pages that render the plugin's login form (which exposes the 'sid'). Note trade-offs: blocking these endpoints will break legitimate form submission and password recovery for users, and unpublishing forms disables the feature, so treat these as stopgaps until 4.0.12 is applied. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/df8326b6-a443-4f76-a755-49f89af74d7e) and audit administrator accounts for unexpected password changes.

Affected VersionsENISA

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder 0 ≤4.0.11

Affected Packages

euvd easy_form_builder_by_whitestudio_drag_drop_form_builder no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is a WordPress form-builder plugin (CPE cpe:2.3:a:hassantafreshi:easy_form_builder_by_whitestudio...) that ships a custom REST API namespace ('Emsfb/v1') layered on WordPress's nonce and user-management primitives. The root cause maps to CWE-269 (Improper Privilege Management): the recovery logic in class-Emsfb-public.php stores the session identifier 'sid' - which is rendered publicly in the login form markup - as the password reset token in the wp_emsfb_temp_links table, so the secret that should gate a reset is in fact public. Compounding this, the Emsfb/v1/nonce/refresh endpoint issues legitimate WordPress REST nonces to unauthenticated callers, defeating the anti-CSRF/authorization check that WordPress nonces are meant to provide and allowing the recovery and set-password endpoints to be called freely.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated, network-reachable REST endpoints with no user interaction and low complexity yield full administrator takeover, so PR:N/UI:N/AC:L and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user - including administrators - by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.

Articles & Coverage 1

News Critical Account Takeover in WordPress Easy Form Builder Plugin - CVE-2026-13439 Jul 21, 2026

Executive ViewAI

Why It Matters

Easy Form Builder for WordPress (versions through 4.0.11) contains a critical authentication bypass allowing unauthenticated remote attackers to reset administrator passwords and seize full control of affected websites. Any organization operating this plugin faces immediate risk of complete site compromise and unauthorized access to sensitive data. Rapid audit and remediation are required across all WordPress deployments.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) immediately deactivate and remove the plugin; (2) implement WAF rules blocking the vulnerable password recovery endpoints and nonce-refresh functions; (3) restrict wp-admin and wp-json access to known IP ranges; (4) enforce multi-factor authentication on all WordPress user accounts; (5) monitor web server and WordPress audit logs for password reset requests and admin account access anomalies.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Prevalence

Low

niche individual-author WordPress form plugin, limited installation footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.