# Everest Forms <= 3.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Form Data

- **ID:** WPSEC-2026-2677
- **Plugin:** Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (`everest-forms`), https://wordpress.org/plugins/everest-forms/
- **Affected versions:** all versions before 3.6.4
- **Fixed in:** 3.6.4 (Update to 3.6.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/everest-forms
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2677/

## Description

The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the block editor form data in all versions up to, and including, 3.6.3. This is due to full form post objects being localized into the block editor for every user who can open it, including the post content that holds all form settings. This makes it possible for authenticated attackers, with contributor-level access and above, to read the complete configuration of all published forms, including email notification settings and integration details.

## References

- https://wpsec.com/vuln/WPSEC-2026-2677/
- https://plugins.svn.wordpress.org/everest-forms/tags/3.6.4/
- https://wordpress.org/plugins/everest-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2677/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.