Insecure Direct Object Reference Vulnerability in Everest Forms Plugin for WordPress
CVE-2026-89101

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder With Ai
Vendor
CVE Published:
6 November 2026

What is CVE-2026-89101?

The Everest Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This issue arises from the lack of proper validation on user-controlled keys within the plugin's get_entry functionality. Consequently, authenticated attackers with custom-level access can retrieve and manipulate forms and their entries that belong to other users. This exploitation allows unauthorized access to sensitive personally identifiable information submitted through forms, including contact and lead data, unrestricted by form ownership. It is crucial for users of Everest Forms to address this vulnerability to safeguard sensitive information.

Affected Version(s)

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 0 <= 3.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/everest-forms/...
https://plugins.trac.wordpress.org/browser/everest-forms/...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trgomez
.