Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Sensitive Information Exposure via Smart Tags in Submitted Form Field Values
- ID
- WPSEC-2026-0201
- Plugin
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (everest-forms)
- Affected
- from 3.2.3 before 3.6.2
- Remediation
- Update to 3.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI on WPSec AttackSurface
- Fix released
- Published
Description
The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tags in submitted form field values in versions 3.2.3 up to, and including, 3.6.1. This is due to the plugin expanding smart tags in every submitted field value, not just hidden fields, and the post_meta smart tags not blocking protected meta keys. This makes it possible for unauthenticated attackers to place smart tags such as {post_meta key=...} in ordinary text fields, which are expanded before the values are stored in entries and used in notification emails. The attacker sees the expanded value only where the form echoes submitted values back to the submitter, such as the submission preview or a confirmation email, and can then read metadata of published posts, including protected meta keys.
References
- https://wpsec.com/vuln/WPSEC-2026-0201/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.2/
- https://wordpress.org/plugins/everest-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS