Skip to content
Threat Feed
Subscribe

Vendor

WhiteStudio

1 brief RSS
critical advisory

WordPress Easy Form Builder Plugin Vulnerable to Unauthenticated Administrator Privilege Escalation (CVE-2026-13439)

An unauthenticated privilege escalation vulnerability exists in the Easy Form Builder by WhiteStudio plugin for WordPress, affecting versions up to and including 4.0.11, allowing attackers to exploit a flaw in the password recovery process by using a publicly visible session identifier ('sid') as a reset token, combined with a publicly accessible nonce refresh endpoint, to set an arbitrary new password for any WordPress user, including administrators, to gain full control.

Easy Form Builder by WhiteStudio plugin for WordPress <= 4.0.11 wordpress plugin privilege-escalation web-vulnerability
1r 2t 1c