WordPress Form Builder Unauthenticated Admin Privilege Escalation

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Easy Form Builder by WhiteStudio plugin for WordPress (versions ≤4.0.11) contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrator access. The vulnerability chains two design flaws: the password recovery mechanism uses a publicly-visible session identifier as the reset token, and a publicly-accessible REST endpoint issues valid WordPress nonces to any visitor without authentication. This combination enables attackers to bypass authentication entirely and escalate to the highest privilege level. Any WordPress site running this plugin is at immediate risk, as exploitation requires no authentication, no user interaction, and leaves victims with compromised administrative control of their entire platform.

Casky's 224 mapped skills detect the attack patterns behind this vulnerability across MITRE ATT&CK's TA0004 (Privilege Escalation) technique. Claude's extended reasoning identifies the two-stage exploitation: first, detecting anomalous REST API calls to the nonce refresh endpoint from unauthenticated sources, then correlating those nonces with suspicious password reset token usage in wp_emsfb_temp_links. Practitioners using Casky would see findings flagging CWE-269 (Improper Access Control) violations—specifically, publicly-accessible sensitive endpoints combined with weak token generation. The platform would surface indicators like repeated /Emsfb/v1/nonce/refresh requests, successful WordPress REST operations from previously-unknown IPs, and sudden admin account creation or password changes correlating with those API calls, enabling defenders to catch exploitation attempts before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13439.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13439

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13439. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn