Vulnerabilities / Everest Forms / WPSEC-2026-2676
Everest Forms <= 3.6.3 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Preview
Medium 4.3
CWE-862Fixed in 3.6.4
- ID
- WPSEC-2026-2676
- Plugin
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (everest-forms)
- Affected
- all versions before 3.6.4
- Remediation
- Update to 3.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Everest Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the email preview feature in all versions up to, and including, 3.6.3. This is due to a missing capability check when the email preview template loads a form chosen by the user. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the email notification message content of any form through the 'evf_email_preview' and 'form_id' parameters.
References
- https://wpsec.com/vuln/WPSEC-2026-2676/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.4/
- https://wordpress.org/plugins/everest-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS