Easy Form Builder WordPress Plugin Vulnerable to Critical Privilege Escalation
The Easy Form Builder by WhiteStudio plugin for WordPress reportedly contains a critical vulnerability that could allow unauthenticated privilege escalation to administrator level in versions up to and including 4.0.11.
What happened
An early warning has been issued regarding a critical vulnerability in the Easy Form Builder by WhiteStudio plugin for WordPress. Versions up to and including 4.0.11 appear to be affected. The vulnerability, tracked as CVE-2026-13439, is due to the password recovery flow using a publicly-visible session identifier ('sid') as the password reset token, combined with a publicly-accessible nonce refresh endpoint that issues valid WordPress REST nonces to unauthenticated visitors. This could allow unauthenticated attackers to reset the password of any WordPress user, including administrators, by exploiting the password recovery flow. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. It is under investigation and users are advised to upgrade to the latest version of the plugin and review user accounts for any suspicious activity.
How 0Day mitigates this
easy form builder is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.