{"id":"CVE-2026-120837","kind":"vulnerability","aliases":["CVE-2026-120837"],"related":[],"title":"Everest Forms WordPress plugin: missing authorization check through 3.6.3","description":"Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Forms: from n/a through 3.6.3.","summary":"Everest Forms, a WordPress form-builder plugin, has a missing authorization check that lets a user reach functions they should not access. The sources do not say what data or actions an attacker gets beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["everest-forms","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Everest Forms version in the WordPress admin plugin list or with `wp plugin get everest-forms --field=version`\n- Compare the result with the fixed version: unknown","fix":"- Everest Forms: unknown (sources say the issue affects versions through `3.6.3` but name no fixed version)","status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:38+00:00","updated_at":"2026-11-07T11:48:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T11:48:38Z","model":"claude-haiku-5-5","output":{"fix":"- Everest Forms: unknown (sources say the issue affects versions through `3.6.3` but name no fixed version)","reach":"internet","title":"Everest Forms WordPress plugin: missing authorization check through 3.6.3","impact":"medium","summary":"Everest Forms, a WordPress form-builder plugin, has a missing authorization check that lets a user reach functions they should not access. The sources do not say what data or actions an attacker gets beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","everest-forms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to plugin functions the site should restrict","analyst_note":"Check the NVD entry and the Everest Forms changelog for the fixed version and the exact vulnerable function and required role.","how_to_check":"- Check the installed Everest Forms version in the WordPress admin plugin list or with `wp plugin get everest-forms --field=version`\n- Compare the result with the fixed version: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Everest Forms WordPress plugin at version `3.6.3` or earlier are in the affected range. Sites without this plugin are not affected. The sources do not say which roles or settings are needed to reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4212,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120837':12A,15A '-2026':11A,14A '3.6.3':9A,83C 'access':43B,72C 'action':52B 'affect':77C 'allow':68C 'attack':54B 'author':6A,32B,58C 'beyond':56B 'builder':27B 'check':7A,33B 'configur':71C 'control':73C 'cve':10A,13A 'data':50B 'everest':1A,17B,21B,61C,63C,66C,78C 'everest-form':16B,65C 'exploit':69C 'form':2A,18B,22B,26B,62C,64C,67C,79C 'form-build':25B 'function':39B 'get':55B 'incorrect':70C 'issu':76C 'let':35B 'levels.this':75C 'miss':5A,31B,57C 'n/a':81C 'packag':19B 'plugin':4A,28B 'reach':38B 'say':48B 'secur':74C 'sourc':45B 'user':37B 'vulner':59C 'wordpress':3A,20B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Everest Forms WordPress plugin at version `3.6.3` or earlier are in the affected range. Sites without this plugin are not affected. The sources do not say which roles or settings are needed to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["everestforms","medium","package","wordpress"],"campaign_type":null,"search_a":"'-120837':12A,15A '-2026':11A,14A '3.6.3':9A 'author':6A 'check':7A 'cve':10A,13A 'everest':1A 'form':2A 'miss':5A 'plugin':4A 'wordpress':3A","search_b":"'access':43B 'action':52B 'attack':54B 'author':32B 'beyond':56B 'builder':27B 'check':33B 'data':50B 'everest':17B,21B 'everest-form':16B 'form':18B,22B,26B 'form-build':25B 'function':39B 'get':55B 'let':35B 'miss':31B 'packag':19B 'plugin':28B 'reach':38B 'say':48B 'sourc':45B 'user':37B 'wordpress':20B,24B","search_c":"'3.6.3':83C 'access':72C 'affect':77C 'allow':68C 'author':58C 'configur':71C 'control':73C 'everest':61C,63C,66C,78C 'everest-form':65C 'exploit':69C 'form':62C,64C,67C,79C 'incorrect':70C 'issu':76C 'levels.this':75C 'miss':57C 'n/a':81C 'secur':74C 'vulner':59C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120837","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}