What is the CVSS score of EUVD-2026-46156?

EUVD-2026-46156 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Easy Form Builder are affected by EUVD-2026-46156?

Easy Form Builder for WordPress (versions through 4.0.11) contains a critical authentication bypass allowing unauthenticated remote attackers to reset administrator passwords and seize full control…

How to fix or mitigate EUVD-2026-46156?

Within 24 hours: audit all WordPress installations for Easy Form Builder plugin presence and deactivate it immediately if found; document all deployments by version and hosting environment. Within 7 days: implement Web Application Firewall (WAF) rules to block requests to the plugin's password recovery and nonce endpoints for all external traffic; enable real-time logging and alerting on admin password reset attempts and account modifications. Within 30 days: migrate all forms to an alternative form builder solution with demonstrated secure password recovery; remove Easy Form Builder entirely from all environments and verify no plugin artifacts remain.

Easy Form Builder EUVD-2026-46156

| CVE-2026-13439 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 Wordfence

GHSA-3h5m-xwq3-mjmq

WordPress Privilege Escalation Wordpress Plugin Easy Form Builder By Whitestudio Drag Drop Form Builder

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-reachable REST endpoints with no user interaction and low complexity yield full administrator takeover, so PR:N/UI:N/AC:L and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 06:01 vuln.today

CVE Published

Jul 21, 2026 - 05:35 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user - including administrators - by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.

Articles & Coverage 1

News Critical Account Takeover in WordPress Easy Form Builder Plugin - CVE-2026-13439 Jul 21, 2026

AnalysisAI

Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.

Technical ContextAI

The affected component is a WordPress form-builder plugin (CPE cpe:2.3:a:hassantafreshi:easy_form_builder_by_whitestudio...) that ships a custom REST API namespace ('Emsfb/v1') layered on WordPress's nonce and user-management primitives. The root cause maps to CWE-269 (Improper Privilege Management): the recovery logic in class-Emsfb-public.php stores the session identifier 'sid' - which is rendered publicly in the login form markup - as the password reset token in the wp_emsfb_temp_links table, so the secret that should gate a reset is in fact public. Compounding this, the Emsfb/v1/nonce/refresh endpoint issues legitimate WordPress REST nonces to unauthenticated callers, defeating the anti-CSRF/authorization check that WordPress nonces are meant to provide and allowing the recovery and set-password endpoints to be called freely.

RemediationAI

Vendor-released patch: update the Easy Form Builder plugin to version 4.0.12 or later, which is the fix confirmed by the WordPress.org changeset between tags 4.0.11 and 4.0.12 (fix committed in changeset 3588226 to class-Emsfb-public.php). This is the primary and only complete remediation. If immediate patching is not possible, remove or deactivate the plugin, since the flaw is inherent to its recovery flow; as interim compensating controls, block or restrict unauthenticated access to the plugin's REST routes at the web/WAF layer - specifically Emsfb/v1/nonce/refresh, Emsfb/v1/forms/message/add, and Emsfb/v1/forms/recovery/efb_set_password - and unpublish or restrict any public pages that render the plugin's login form (which exposes the 'sid'). Note trade-offs: blocking these endpoints will break legitimate form submission and password recovery for users, and unpublishing forms disables the feature, so treat these as stopgaps until 4.0.12 is applied. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/df8326b6-a443-4f76-a755-49f89af74d7e) and audit administrator accounts for unexpected password changes.