WordPress Plugin Vulnerabilities

Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion

Description

The plugin does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.

Proof of Concept

Affects Plugins

Plugin icon
easy-form-builder
Fixed in 4.2.0

References

CVE
CVE-2026-85123

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
a4968578-aac9-4500-bfb1-f5db95a61921

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2022-02-11
Title
Email Subscribers & Newsletters < 5.3.2 - Unauthenticated arbitrary option update
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
Published
2020-12-14
Title
Total Upkeep by BoldGrid < 1.14.10 - Unauthenticated Backup Download
Published
2024-02-06
Title
Customer Reviews for WooCommerce < 5.39.0 - Improper Authorization via submit_review
Published
2024-02-08
Title
Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure