- Son 7 gün
- CWE-639
CVE-2026-89101
Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure…
wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Yayımlandı
- Güncellendi
- 6 Kas 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- Wordfence
Özet
Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | ≤ 3.6.2 | – |
Kaynaklar14 kaynak
- CVE.org kaydı
- NVD kaydı
- wordfence.com/…lities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
- plugins.trac.wordpress.org/….1/includes/abilities/class-evf-mcp-server.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-registry.php Diğer
- plugins.trac.wordpress.org/…des/abilities/class-evf-abilities-handlers.php Diğer
Kayıt geçmişi
- Yayımlandı