Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Authenticated (Delegated+) Insecure Direct Object Reference via MCP Form and Entry Abilities
- ID
- WPSEC-2026-0200
- Plugin
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (everest-forms)
- Affected
- from 3.5.0 before 3.6.2
- Remediation
- Update to 3.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI on WPSec AttackSurface
- Fix released
- Published
Description
The Everest Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference via its MCP and Abilities form and entry handlers in versions 3.5.0 up to, and including, 3.6.1. This is due to the permission callbacks checking only plural capabilities without the targeted form or entry ID, which bypasses the plugin's own-versus-others ownership checks, and to site-wide counts, listings and bulk deletion not being restricted to the caller's own forms. This makes it possible for authenticated attackers who have been granted Everest Forms' own-scoped form or entry capabilities, for example through the plugin's Roles and Permission tool, to view, modify, duplicate, or delete forms and entries belonging to other users, and to view other users' entry statistics.
References
- https://wpsec.com/vuln/WPSEC-2026-0200/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.2/
- https://wordpress.org/plugins/everest-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS