Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Form Field Values
- ID
- WPSEC-2026-1051
- Plugin
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (everest-forms)
- Affected
- all versions before 3.6.3
- Remediation
- Update to 3.6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI on WPSec AttackSurface
- Fix released
- Published
Description
The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tag injection in submitted form field values in all versions up to, and including, 3.6.2. This is due to the smart tag processor substituting submitted field values into notification, confirmation and redirect content before it resolves the other smart tags, and to the plugin resolving smart tags in the submitted value of hidden fields. This makes it possible for unauthenticated attackers to put smart tags such as {post_meta key=...} into a form submission and have them resolved, exposing non-protected post meta and other server-side data through notification emails, confirmation output, redirect query strings or stored entries. This flaw remained after the incomplete fix in version 3.6.2.
References
- https://wpsec.com/vuln/WPSEC-2026-1051/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.3/
- https://wordpress.org/plugins/everest-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS