Authorization Bypass in Everest Forms Plugin for WordPress

CVE-2026-13167

What is CVE-2026-13167?

The Everest Forms plugin for WordPress is affected by an authorization bypass vulnerability that allows authenticated attackers with delegated form management permissions to activate arbitrary WordPress plugins, including those that have been previously deactivated or contain vulnerabilities. This issue arises from the plugin's failure to verify user authorization appropriately and enables users assigned with delegated capabilities—like managing or viewing forms—to exploit nonces exposed on admin pages. Consequently, this poses a significant risk as it can result in unauthorized access and potential exploitation of additional vulnerabilities within the WordPress environment.

References