Is CVE-2026-85123 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85123 being exploited in the wild.

How severe is CVE-2026-85123?

Medium severity, with a CVSS score of 5.3, published 18 September 2026.

Which products and versions are affected?

WhiteStudio Easy Form Builder 4.0.0 through 4.1.3.

Is there a fix for CVE-2026-85123?

A patch was published on 2026-09-18: Fixed in version 4.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85123 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85123?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85123: Easy Form Builder by WhiteStudio registration policy bypass

CVE-2026-85123 · Severity: medium · CVSS 5.3 · Published 2026-09-18

Easy Form Builder is a WordPress plugin used to create web forms on WordPress sites. The plugin fails to properly validate form submissions, allowing attackers to create WordPress user accounts on sites where the site owner has intentionally disabled registration. This bypasses the site owner's security policy and can lead to unauthorized account creation and potential site compromise.

Quick answers

Is CVE-2026-85123 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85123 being exploited in the wild.
How severe is CVE-2026-85123?: Medium severity, with a CVSS score of 5.3, published 18 September 2026.
Which products and versions are affected?: WhiteStudio Easy Form Builder 4.0.0 through 4.1.3.
Is there a fix for CVE-2026-85123?: A patch was published on 2026-09-18: Fixed in version 4.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85123 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85123?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control issue (CWE-284) in the form validation logic. The plugin does not validate submitted form values against the stored configuration for certain form types, particularly login/registration forms. An unauthenticated attacker can submit a crafted form request to bypass the site's user registration restrictions, allowing arbitrary account creation. The vulnerability affects Easy Form Builder versions 4.0.0 through 4.1.3 and is fixed in version 4.2.0. No network-based authentication is required; exploitation requires only network access to the vulnerable WordPress installation.

Affected products

WhiteStudio Easy Form Builder 4.0.0 through 4.1.3

Timeline

2026-09-16: disclosed
2026-09-18: patched: Fixed in version 4.2.0

References

https://wpscan.com/vulnerability/a4968578-aac9-4500-bfb1-f5db95a61921/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.