CVE-2026-13439: Unauthenticated Privilege Escalation in Easy Form Builder by WhiteStudio WordPress Plugin

Executive Summary

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to unauthenticated privilege escalation to administrator in versions up to 4.0.11. This vulnerability allows unauthenticated attackers to reset the password of any WordPress user, including administrators, and gain full administrator access. The vulnerability has a CVSS score of 9.8, indicating critical severity.

Technical Analysis

The vulnerability is caused by the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in `wp_emsfb_temp_links`, combined with a publicly-accessible nonce refresh endpoint (`Emsfb/v1/nonce/refresh`) that issues valid WordPress REST nonces to unauthenticated visitors. This allows unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public `sid` from a published login form page, submitting a recovery request for any known user email via `Emsfb/v1/forms/message/add`, and then calling `Emsfb/v1/forms/recovery/efb_set_password` with the known `sid` to set an arbitrary new password and gain full administrator access.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by: - Scraping the public `sid` from a published login form page. - Submitting a recovery request for any known user email via `Emsfb/v1/forms/message/add`. - Calling `Emsfb/v1/forms/recovery/efb_set_password` with the known `sid` to set an arbitrary new password. This results in the attacker gaining full administrator access to the WordPress site.

Impact Assessment

The Easy Form Builder by WhiteStudio plugin for WordPress versions up to 4.0.11 are affected. An attacker can achieve unauthenticated privilege escalation to administrator, allowing them to reset the password of any WordPress user, including administrators, and gain full administrator access. The CVSS score of 9.8 indicates critical severity.

Recommended Actions

- Update the Easy Form Builder by WhiteStudio plugin to version 4.0.12 or later. - Block access to the publicly-accessible nonce refresh endpoint (`Emsfb/v1/nonce/refresh`). - Implement a Web Application Firewall (WAF) rule to detect and prevent suspicious activity on the `Emsfb/v1/forms/recovery/efb_set_password` endpoint.

Sources

- National Vulnerability Database (NVD)