The plugin’s password recovery mechanism uses the public session ID as a reset token stored in wp_emsfb_temp_links and a publicly accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This combination allows an unauthenticated attacker to reset the password of any WordPress user—including administrators—by first scraping the sid value from a published login form page, then submitting a recovery request for a known user email via Emsfb/v1/forms/message/add, and finally calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set a new password. The attacker achieves full administrator access, representing a high‑impact privilege escalation vulnerability (CWE‑269).

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder for WordPress. All releases up to and including version 4.0.11 are vulnerable. WordPress sites that have installed the plugin in any of these versions, regardless of active usage, are impacted.

CVSS score is 9.8, indicating critical severity. The EPSS score is less than 1%, suggesting that while the vulnerability is unlikely to be widely exploited at present, the existence of public REST endpoints means an attacker could perform the exploit at any time with no special environment. The vulnerability is not listed in the CISA KEV catalog. The attack vector is web‑based; an unauthenticated attacker only needs HTTP access to the target site, making the exploit relatively straightforward and low‑barrier. Because the attacker can reset any user password, the potential impact is complete compromise of the WordPress installation.