CVE-2026-85123 — Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

CVE-2026-85123

Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion PUBLISHED

Description (CNA)

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.

Affected (CNA)

Vendor / product	Versions
Unknown / Easy Form Builder by WhiteStudio	affected 4.0.0 before 4.2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a4968578-aac9-4500-bfb1-f5db95a61921/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.