Executive brief
Easy Form Builder is a WordPress plugin used to create web forms on WordPress sites. The plugin fails to properly validate form submissions, allowing attackers to create WordPress user accounts on sites where the site owner has intentionally disabled registration. This bypasses the site owner's security policy and can lead to unauthorized account creation and potential site compromise.
Technical details
The vulnerability is a broken access control issue (CWE-284) in the form validation logic. The plugin does not validate submitted form values against the stored configuration for certain form types, particularly login/registration forms. An unauthenticated attacker can submit a crafted form request to bypass the site's user registration restrictions, allowing arbitrary account creation. The vulnerability affects Easy Form Builder versions 4.0.0 through 4.1.3 and is fixed in version 4.2.0. No network-based authentication is required; exploitation requires only network access to the vulnerable WordPress installation.
Affected products
- WhiteStudio Easy Form Builder 4.0.0 through 4.1.3
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: Fixed in version 4.2.0