CVE-2026-85123: Easy Form Builder Auth Bypass Vulnerability

CVE-2026-85123 Overview

CVE-2026-85123 is an access control weakness in the Easy Form Builder by WhiteStudio WordPress plugin versions before 4.2.0. The plugin fails to validate submitted values against the stored form configuration for certain form types. Unauthenticated attackers can abuse this flaw to create WordPress user accounts on sites where the administrator has disabled public registration.

The vulnerability is classified under [CWE-284] Improper Access Control. It is exploitable over the network without authentication or user interaction. Successful exploitation leads to unauthorized account creation, undermining the site owner's registration policy.

Critical Impact

Unauthenticated attackers can bypass the site's registration setting and provision WordPress accounts, establishing a foothold for further abuse.

Affected Products

• Easy Form Builder by WhiteStudio WordPress plugin versions prior to 4.2.0
• WordPress sites with the plugin installed and registration disabled at the site level
• Any form configuration relying on client-submitted form-type values for validation

Discovery Timeline

• 2026-09-18 - CVE-2026-85123 published to the National Vulnerability Database
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-85123

Vulnerability Analysis

The Easy Form Builder plugin processes form submissions without verifying that the submitted form-type value matches the stored server-side configuration. A form intended for contact or subscription purposes can be repurposed by the client to trigger the user-registration handler. Because the plugin trusts the client-supplied type parameter, the site's global registration policy is not enforced at the form-processing layer.

The result is a business-logic and access-control failure. WordPress exposes a users_can_register option that administrators toggle to prevent open account creation. This plugin bypasses that control by invoking account creation independently through its own handler. The impact is limited to integrity, with no direct confidentiality or availability loss, but the created accounts may be leveraged for privilege escalation, spam, or reconnaissance depending on the default role assigned.

Root Cause

The root cause is missing server-side validation of the submitted form type against the stored form configuration. The plugin does not cross-reference the submission payload with the persisted definition before invoking privileged actions such as user creation. This aligns with [CWE-284] Improper Access Control.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to the plugin's public submission endpoint. The request includes parameters that coerce the handler into treating the submission as a registration form. Because no authorization check ties the submission to the actual stored form definition, the plugin creates a new WordPress account despite users_can_register being disabled.

Exploitation code is not required beyond a standard HTTP client capable of issuing form-encoded POST requests to the vulnerable endpoint. Refer to the WPScan Vulnerability Advisory for the technical write-up.

Detection Methods for CVE-2026-85123

Indicators of Compromise

• Unexpected new entries in wp_users with creation timestamps that do not correlate with legitimate admin activity
• POST requests to Easy Form Builder submission endpoints followed shortly by new-user database writes
• New accounts appearing while the WordPress General Settings show membership registration disabled
• User accounts with generic or automated-looking usernames and email addresses from disposable domains

Detection Strategies

• Compare the count of wp_users rows against the WordPress users_can_register setting; any growth while registration is disabled warrants investigation
• Inspect web server access logs for POST requests to plugin submission handlers correlated with user_register action hooks firing
• Audit the installed plugin version and flag any Easy Form Builder installation earlier than 4.2.0

Monitoring Recommendations

• Enable WordPress audit logging to capture user creation events with source IP and referring URL
• Alert on discrepancies between the site registration policy and observed account creation activity
• Forward web and application logs to a centralized analytics platform for correlation across submission endpoints and user-management events

How to Mitigate CVE-2026-85123

Immediate Actions Required

• Upgrade Easy Form Builder by WhiteStudio to version 4.2.0 or later on all WordPress instances
• Review the wp_users table for unauthorized accounts created since the plugin was installed and remove any that are not legitimate
• Rotate credentials and audit role assignments for any suspicious accounts discovered during review

Patch Information

The vendor addressed the vulnerability in Easy Form Builder version 4.2.0 by validating submitted form-type values against the stored configuration. Site administrators should update through the WordPress plugin management interface or by replacing the plugin files with the patched release. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

• Temporarily deactivate the Easy Form Builder plugin until the update to 4.2.0 can be applied
• Restrict access to the plugin's submission endpoints via web application firewall rules that block unauthenticated registration parameters
• Monitor and manually approve new WordPress accounts until the patched version is deployed

# Verify installed plugin version and update via WP-CLI
wp plugin get easy-form-builder --field=version
wp plugin update easy-form-builder --version=4.2.0

# Confirm registration is disabled at the site level
wp option get users_can_register