CVE-2026-89101
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
| CWE | CWE-639 |
| Vendor | wpeverest |
| Product | everest forms – contact form, payment form, quiz, survey & custom form builder with ai |
| Published | Nov 6, 2026 |
Get instant alerts for wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with ai
Be the first to know when new medium vulnerabilities affecting wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with ai are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N