{
 "id": "WPSEC-2026-1051",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1051/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1051/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1051/index.md",
 "title": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart Tag Injection in Form Field Values",
 "description": "The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tag injection in submitted form field values in all versions up to, and including, 3.6.2. This is due to the smart tag processor substituting submitted field values into notification, confirmation and redirect content before it resolves the other smart tags, and to the plugin resolving smart tags in the submitted value of hidden fields. This makes it possible for unauthenticated attackers to put smart tags such as {post_meta key=...} into a form submission and have them resolved, exposing non-protected post meta and other server-side data through notification emails, confirmation output, redirect query strings or stored entries. This flaw remained after the incomplete fix in version 3.6.2.",
 "plugin": {
  "slug": "everest-forms",
  "name": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI",
  "full_name": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI",
  "wordpress_org": "https://wordpress.org/plugins/everest-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/everest-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/everest-forms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.3",
 "remediation": "Update to 3.6.3 or later.",
 "fix_released": "2026-10-15T06:48:03+00:00",
 "published": "2026-10-16T10:47:15+00:00",
 "updated": "2026-10-16T09:49:57.702588+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1051/",
  "https://plugins.svn.wordpress.org/everest-forms/tags/3.6.3/",
  "https://wordpress.org/plugins/everest-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/everest-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}