CVE-2026-13439 describes an improper privilege management vulnerability (CWE-269) in the Easy Form Builder by WhiteStudio plugin for WordPress, affecting versions up to and including 4.0.11. The vulnerability arises because the password recovery flow uses a publicly visible session identifier ('sid') stored in wp_emsfb_temp_links as the password reset token. Additionally, a publicly accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) issues valid WordPress REST nonces to unauthenticated users. This combination allows an unauthenticated attacker to scrape the public 'sid' from a login form page, submit a password recovery request for any known user email via Emsfb/v1/forms/message/add, and then call Emsfb/v1/forms/recovery/efb_set_password with the known 'sid' to set an arbitrary new password. This results in full administrator access without authentication.

Successful exploitation allows unauthenticated attackers to reset the password of any WordPress user, including administrators, leading to complete site takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical impact with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoints if possible and monitor for suspicious password reset activity. Avoid using the affected plugin version and consider disabling it temporarily to prevent exploitation.