What is CVE-2026-13439?

CVE-2026-13439 is a critical-severity vulnerability in Hassantafreshi Easy Form Builder By Whitestudio – Drag & Drop, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2026-07-21.

How severe is CVE-2026-13439?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Privilege escalation in Hassantafreshi Easy Form Builder By Whitestudio – Drag & Drop

CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible…

Vulnerability class: Privilege Escalation

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hassantafreshi Easy Form Builder By Whitestudio – Drag & Drop — versions 0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

Frequently asked questions

What is CVE-2026-13439?: CVE-2026-13439 is a critical-severity vulnerability in Hassantafreshi Easy Form Builder By Whitestudio – Drag & Drop, classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2026-07-21.
How severe is CVE-2026-13439?: Critical severity. CVSS v3 base score is 9.8 out of 10.