{"id":"CVE-2026-89101","aliases":["EUVD-2026-118188","GHSA-j45v-p6vj-4j8j"],"status":"published","title":"Everest Forms \u003c= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00414,"percentile":0.35967,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-11-06T11:17:35Z","modified":"2026-11-06T12:30:55Z","products":[{"vendor":"wpeverest","product":"everest forms – contact form, payment form, quiz, survey \u0026 custom form builder with ai"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L669"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L686"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L563"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L62"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L30"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L34"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L22"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-handlers.php#L46"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-mcp-server.php#L52"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/abilities/class-evf-abilities-registry.php#L74"},{"url":"https://plugins.trac.wordpress.org/changeset/3704878/everest-forms/trunk/includes/abilities/class-evf-abilities-handlers.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89101"},{"url":"https://github.com/advisories/GHSA-j45v-p6vj-4j8j"}],"sources":{"cve":[{"id":"CVE-2026-89101","title":"Everest Forms \u003c= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","status":"published","published":"2026-11-06T11:17:35.493Z","modified":"2026-11-06T15:15:20.139Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-06T16:58:46.729138Z"}],"euvd":[{"id":"EUVD-2026-118188","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","status":"published","published":"2026-11-06T11:17:35Z","modified":"2026-11-06T15:15:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T16:05:19.944528Z"}],"ghsa":[{"id":"GHSA-j45v-p6vj-4j8j","title":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin...","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","status":"published","published":"2026-11-06T12:30:47Z","modified":"2026-11-06T12:30:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-06T13:00:05.657094Z"}],"nvd":[{"id":"CVE-2026-89101","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey \u0026 Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.","status":"published","published":"2026-11-06T12:17:24.477Z","modified":"2026-11-06T16:18:59.623Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-06T18:00:56.247382Z"}]}}