{"id":"CVE-2026-89101","kind":"vulnerability","aliases":["CVE-2026-89101"],"related":[],"title":"Everest Forms WordPress plugin: missing checks let users read and delete others' forms","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","summary":"The Everest Forms WordPress plugin does not validate a user-controlled key in its get_entry function, so any logged-in user with custom-level access or higher can view, read and permanently delete forms and entries owned by other users. Entries often contain personal data submitted through public contact and lead forms.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["everest-forms","package","wordpress"],"not_affected_if":["no-custom-level-users","plugin-not-installed"],"how_to_check":"- Check the installed Everest Forms plugin version in the WordPress admin under Plugins; the sources say versions up to and including `3.6.2` are affected.\n- Confirm whether custom-level or similar user roles exist on the site.","fix":null,"status":"open","published_at":"2026-11-06T12:17:24+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","triaged_at":"2026-11-06T12:42:48+00:00","updated_at":"2026-11-06T12:42:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T12:42:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Everest Forms WordPress plugin: missing checks let users read and delete others' forms","impact":"medium","summary":"The Everest Forms WordPress plugin does not validate a user-controlled key in its get_entry function, so any logged-in user with custom-level access or higher can view, read and permanently delete forms and entries owned by other users. Entries often contain personal data submitted through public contact and lead forms.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","everest-forms"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated users read and delete other users' form entries containing personal data","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version after 3.6.2.","how_to_check":"- Check the installed Everest Forms plugin version in the WordPress admin under Plugins; the sources say versions up to and including `3.6.2` are affected.\n- Confirm whether custom-level or similar user roles exist on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-custom-level-users"],"who_is_affected":"Sites running the Everest Forms WordPress plugin at version 3.6.2 or earlier where users with custom-level access or higher can log in. The sources do not state a fixed version, so the exposure cannot be ruled out for later releases from the text alone.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4320,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-89101':16A,19A '3.6.2':112C 'access':53B,137C 'ai':94C 'attack':132C 'authent':131C 'belong':149C 'builder':92C 'check':6A 'contact':77B,84C,161C 'contain':71B 'control':36B,124C 'custom':51B,90C,135C 'custom-level':50B,134C 'cve':14A,17A 'data':73B 'delet':11A,61B,145C 'direct':102C 'due':117C 'entri':41B,64B,69B,116C,148C 'everest':1A,21B,26B,82C 'everest-form':20B 'form':2A,13A,22B,27B,62B,80B,83C,85C,87C,91C,146C,164C,167C 'function':42B 'get':40B,115C 'higher':55B 'identifi':156C 'includ':111C,154C 'inform':157C 'insecur':101C 'key':37B,125C 'lead':79B,163C 'let':7A 'level':52B,136C 'log':46B 'logged-in':45B 'make':127C 'miss':5A,119C 'object':103C 'often':70B 'other':12A 'own':65B 'ownership':168C 'packag':23B 'payment':86C 'perman':60B,144C 'person':72B,155C 'plugin':4A,29B,95C 'possibl':129C 'public':76B,160C 'quiz':88C 'read':9A,58B,142C 'refer':104C 'regardless':165C 'submit':74B,158C 'survey':89C 'user':8A,35B,48B,68B,123C,153C 'user-control':34B 'valid':32B,120C 'version':107C 'via':113C 'view':57B,141C 'vulner':99C 'wordpress':3A,24B,28B,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Everest Forms WordPress plugin at version 3.6.2 or earlier where users with custom-level access or higher can log in. The sources do not state a fixed version, so the exposure cannot be ruled out for later releases from the text alone.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["everestforms","medium","package","wordpress"],"campaign_type":null,"search_a":"'-2026':15A,18A '-89101':16A,19A 'check':6A 'cve':14A,17A 'delet':11A 'everest':1A 'form':2A,13A 'let':7A 'miss':5A 'other':12A 'plugin':4A 'read':9A 'user':8A 'wordpress':3A","search_b":"'access':53B 'contact':77B 'contain':71B 'control':36B 'custom':51B 'custom-level':50B 'data':73B 'delet':61B 'entri':41B,64B,69B 'everest':21B,26B 'everest-form':20B 'form':22B,27B,62B,80B 'function':42B 'get':40B 'higher':55B 'key':37B 'lead':79B 'level':52B 'log':46B 'logged-in':45B 'often':70B 'own':65B 'packag':23B 'perman':60B 'person':72B 'plugin':29B 'public':76B 'read':58B 'submit':74B 'user':35B,48B,68B 'user-control':34B 'valid':32B 'view':57B 'wordpress':24B,28B","search_c":"'3.6.2':112C 'access':137C 'ai':94C 'attack':132C 'authent':131C 'belong':149C 'builder':92C 'contact':84C,161C 'control':124C 'custom':90C,135C 'custom-level':134C 'delet':145C 'direct':102C 'due':117C 'entri':116C,148C 'everest':82C 'form':83C,85C,87C,91C,146C,164C,167C 'get':115C 'identifi':156C 'includ':111C,154C 'inform':157C 'insecur':101C 'key':125C 'lead':163C 'level':136C 'make':127C 'miss':119C 'object':103C 'ownership':168C 'payment':86C 'perman':144C 'person':155C 'plugin':95C 'possibl':129C 'public':160C 'quiz':88C 'read':142C 'refer':104C 'regardless':165C 'submit':158C 'survey':89C 'user':123C,153C 'valid':120C 'version':107C 'via':113C 'view':141C 'vulner':99C 'wordpress':97C","first_public_at":"2026-11-06T12:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89101","severity":null,"published_at":"2026-11-06T12:17:24+00:00","modified_at":"2026-11-06T12:17:24+00:00","first_seen_at":"2026-11-06T12:41:49+00:00","fetched_at":"2026-11-06T12:41:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}