Easy Form Builder by WhiteStudio WordPress Plugin Allows Unauthenticated Full Administrator Takeover (CVE-2026-13439)

Scope: Easy Form Builder by WhiteStudio WordPress Plugin Versions up to and Including 4.0.11

Severity: Red

Disclosed today, July 21, 2026, CVE-2026-13439 (CVSS 9.8) is one of the most severe classes of WordPress plugin vulnerability, allowing a completely unauthenticated attacker with no account, no credentials, and no prior access to reset the password of any user on the site including administrators and gain full WordPress administrative control in three simple steps. The flaw exists because the plugin's password recovery flow uses the publicly visible session identifier (sid) embedded on any published login form page as the effective password reset token, and simultaneously exposes an unauthenticated REST endpoint (Emsfb/v1/nonce/refresh) that freely issues valid WordPress security nonces to anonymous visitors. Any attacker can scrape the public sid from the login page, submit a recovery request for any known user email, and then call Emsfb/v1/forms/recovery/efb_set_password with the known sid and a freely obtained nonce to set an arbitrary new password. Organizations running Easy Form Builder must update to version 4.0.12 immediately, audit the WordPress user database for any unexpected administrator accounts added since the plugin was installed, and rotate all administrator passwords as a precautionary measure.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.