CVE-2026-120837: WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Everest Forms Everest Forms everest-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Forms: from n/a through 3.6.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/everest-formsto a version that resolves this vulnerability.Fixed in 3.6.4
Event History
Frequently Asked Questions
Which Everest Forms installations are affected?
The issue affects Everest Forms versions through 3.6.3. The available data does not identify a lower affected version boundary.
What access does an attacker need to exploit this issue?
The available data identifies the weakness as missing authorization and incorrectly configured access-control security levels, but does not state the attacker’s required authentication level or privileges.
Are default Everest Forms configurations affected?
The available data does not say whether the vulnerable access-control condition is present in default configurations or requires specific settings.
How can I determine whether exploitation has already occurred?
The provided information does not include indicators of compromise, affected endpoints, logging guidance, or other detection details.