CVE-2026-89101 · Package
NO FIX YET
The Everest Forms WordPress plugin does not validate a user-controlled key in its get_entry function, so any logged-in user with custom-level access or higher can view, read and permanently delete forms and entries owned by other users. Entries often contain personal data submitted through public contact and lead forms.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Everest Forms WordPress plugin at version 3.6.2 or earlier where users with custom-level access or higher can log in. The sources do not state a fixed version, so the exposure cannot be ruled out for later releases from the text alone.
Not affected if no-custom-level-users, plugin-not-installed
Who cares everest-forms, wordpress
3.6.2 are affected.No fix yet, per the sources.
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.