CVE-2026-89101

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89101", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-09-10T21:48:21.571Z", "datePublished": "2026-11-06T11:17:35.493Z", "dateUpdated": "2026-11-06T15:15:20.139Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-06T11:17:35.493Z"}, "affected": [{"vendor": "wpeverest", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user \u2014 including personally identifiable information submitted through public contact and lead forms \u2014 regardless of form ownership."}], "title": "Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Trgomez"}], "timeline": [{"time": "2026-09-10T21:48:37.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-11-05T22:19:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T15:11:31.472742Z", "id": "CVE-2026-89101", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:15:20.139Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:11:31.472742Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:15:12.501Z"}}], "cna": {"title": "Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint", "credits": [{"lang": "en", "type": "finder", "value": "Trgomez"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wpeverest", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-10T21:48:37.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-11-05T22:19:09.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"}], "descriptions": [{"lang": "en", "value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user \u2014 including personally identifiable information submitted through public contact and lead forms \u2014 regardless of form ownership."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-06T11:17:35.493Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89101", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:15:20.139Z", "dateReserved": "2026-09-10T21:48:21.571Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-11-06T11:17:35.493Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI", "vendor": "wpeverest", "versions": [{"lessThanOrEqual": "3.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user \u2014 including personally identifiable information submitted through public contact and lead forms \u2014 regardless of form ownership."}], "id": "CVE-2026-89101", "lastModified": "2026-11-06T16:18:59.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89101", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:11:31.472742Z", "version": "2.0.3"}}]}, "published": "2026-11-06T12:17:24.477", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.2]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "everest_forms", "vendor": "wordpress-extensions"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI", "source": "cna", "vendor": "wpeverest"}, "product": "everest_forms", "vendor": "wpeverest"}], "created": "2026-11-06T12:30:04.396360+00:00", "updated": "2026-11-06T13:45:03.628831+00:00", "vendors": ["wordpress-extensions", "wordpress-extensions$PRODUCT$everest_forms", "wpeverest", "wpeverest$PRODUCT$everest_forms"]}