CVE-2026-89101mediumCWE-639

CVE-2026-89101: falha de média gravidade em wpeverest Everest Forms – Contact Form…

Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint

Publicada em

Seguir esta CVE+ Monitorar Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
CVEs relacionadas — wpeverest Everest Forms – Contact Form…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-91153MEDIUMEverest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})EPSS 0.6%CVE-2026-13167MEDIUMEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX EndpointsEPSS 0.5%CVE-2026-5096MEDIUMEverest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'EPSS 0.4%CVE-2026-91152MEDIUMEverest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' ParameterEPSS 0.3%