A critical privilege escalation vulnerability in the Easy Form Builder plugin for WordPress allows unauthenticated attackers to compromise administrative accounts.

This vulnerability stems from improper privilege management where the plugin uses publicly visible session identifiers as password reset tokens. An unauthenticated attacker can exploit this, combined with a publicly accessible nonce refresh endpoint, to reset passwords for any user, including administrators.

An attacker gaining administrative access to a WordPress site can exercise full control over the environment. This includes installing malicious plugins, modifying site content, exfiltrating sensitive database information, and using the site to distribute malware. The CVSS score of 9.8 reflects the ease of access and the total loss of confidentiality and integrity.

Immediate Action: Update the Easy Form Builder plugin to version 4.0.12 or the latest available version immediately.

Proactive Monitoring: Audit WordPress user accounts for unauthorized additions or changes to administrative privileges and monitor logs for unusual activity originating from the plugin's REST API endpoints.

Compensating Controls: Temporarily disable the plugin if an immediate update is not feasible, or use a WAF to block access to the Emsfb/v1/forms/recovery/efb_set_password and nonce refresh endpoints.

Public Exploit Available: No

This vulnerability presents a severe risk to any WordPress site utilizing the Easy Form Builder plugin. Security teams must verify the plugin version across all installations and apply the patch without delay. Given the potential for complete site takeover, this should be treated as a high-priority remediation task.