CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-13439

The CVE-2026-13439 entry affects the WordPress plugin Easy Form Builder by WhiteStudio up to version 4.0.11 , where the password-recovery flow relies on a publicly visible session identifier ('sid') as the reset token stored in wp_emsfb_temp_links, combined with a publicly accessible nonce refres...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...