Description

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T12:17:24.477Z",
  "pubdate": "2026-11-06T12:17:24.477Z",
  "executiveSummary": "The Everest Forms plugin for WordPress, in all versions up to and including 3.6.2, contains a critical Insecure Direct Object Reference (IDOR) vulnerability.\nThis security flaw stems from insufficient validation of user-controlled keys within the get_entry function.\nThe vulnerability allows authenticated attackers possessing custom-level access or higher to bypass authorization controls, granting them unauthorized read and delete permissions over forms and entries associated with other users.\nThis includes the exposure of sensitive personally identifiable information (PII) harvested from public-facing contact, payment, and lead forms.\nThe impact is significant, as it facilitates data breaches and unauthorized data destruction, compromising the confidentiality and integrity of user submissions.\nSuccessful exploitation requires the attacker to be authenticated with specific privileges, but does not necessitate elevated administrative access beyond the 'custom' level, widening the potential attack surface within multi-user environments.",
  "technicalDetails": "The vulnerability is localized within the plugin's entry management logic, specifically the get_entry function. The root cause is a lack of rigorous server-side authorization checks on the parameters passed to this function. When a request is processed, the application fails to verify if the requesting authenticated user possesses the appropriate ownership or permission level to access the requested object ID.\nThe attack vector leverages the predictable nature of entry or form identifiers. By manipulating these parameters in a request to the server, an attacker can coerce the get_entry function into returning data for objects they do not own. Because the function does not validate the object reference against the user's session context, the server treats the request as legitimate.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a user with at least custom-level access. 2) The attacker intercepts or crafts a request targeting the get_entry endpoint. 3) The attacker modifies the object identifier parameter to correspond with target entries or forms owned by other users or administrators. 4) The server processes the request, failing to perform an access control check, and returns the requested object data or executes the requested deletion command.\nThe vulnerability affects all plugin versions up to and including 3.6.2. The exposure extends to the plugin's database interactions, specifically where the API or backend handlers process requests for entry retrieval and deletion. Since the vulnerability allows for the permanent deletion of records, it creates a persistent threat to data availability in addition to the breach of confidentiality regarding PII.\nThe post-exploitation impact includes the systematic extraction of PII collected via contact forms, survey submissions, and payment logs, potentially leading to compliance violations such as GDPR or CCPA. Furthermore, the ability to delete entries provides an attacker with a mechanism to disrupt business operations and tamper with the integrity of lead generation or transactional records stored within the WordPress database."
}