Vulnerabilities / Everest Forms / WPSEC-2026-2677
Everest Forms <= 3.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Form Data
Medium 4.3
CWE-200Fixed in 3.6.4
- ID
- WPSEC-2026-2677
- Plugin
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (everest-forms)
- Affected
- all versions before 3.6.4
- Remediation
- Update to 3.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- Everest Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the block editor form data in all versions up to, and including, 3.6.3. This is due to full form post objects being localized into the block editor for every user who can open it, including the post content that holds all form settings. This makes it possible for authenticated attackers, with contributor-level access and above, to read the complete configuration of all published forms, including email notification settings and integration details.
References
- https://wpsec.com/vuln/WPSEC-2026-2677/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.4/
- https://wordpress.org/plugins/everest-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS