{
 "id": "WPSEC-2026-2677",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2677/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2677/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2677/index.md",
 "title": "Everest Forms <= 3.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Form Data",
 "description": "The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the block editor form data in all versions up to, and including, 3.6.3. This is due to full form post objects being localized into the block editor for every user who can open it, including the post content that holds all form settings. This makes it possible for authenticated attackers, with contributor-level access and above, to read the complete configuration of all published forms, including email notification settings and integration details.",
 "plugin": {
  "slug": "everest-forms",
  "name": "Everest Forms",
  "full_name": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI",
  "wordpress_org": "https://wordpress.org/plugins/everest-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/everest-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/everest-forms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.4",
 "remediation": "Update to 3.6.4 or later.",
 "fix_released": "2026-11-05T15:37:46+00:00",
 "published": "2026-11-06T15:42:23+00:00",
 "updated": "2026-11-06T12:01:53.089555+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2677/",
  "https://plugins.svn.wordpress.org/everest-forms/tags/3.6.4/",
  "https://wordpress.org/plugins/everest-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/everest-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}