CVE-2026-13167: CWE-862 Missing Authorization in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
AI Analysis
Technical Summary
CVE-2026-13167 describes an authorization bypass vulnerability in the Everest Forms plugin for WordPress, affecting all versions up to and including 3.5.2. The plugin fails to properly verify that a user is authorized to perform plugin activation actions. As a result, authenticated users with delegated Everest Forms capabilities (such as manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms) can activate arbitrary installed WordPress plugins without requiring the core activate_plugins capability. The plugin's roles and permissions system allows administrators to assign these delegated capabilities to non-administrator roles like Author. The AJAX handlers involved emit nonces on admin pages accessible to such delegated users, facilitating exploitation. This vulnerability is categorized under CWE-862 (Missing Authorization).
Potential Impact
The vulnerability allows authenticated users with delegated Everest Forms permissions to activate any installed WordPress plugin, including previously deactivated or vulnerable plugins, without holding the standard activate_plugins capability. This can lead to integrity impact by enabling unauthorized changes to the WordPress environment. There is no direct confidentiality or availability impact reported. The CVSS score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring privileges but no user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated Everest Forms capabilities to trusted users only and review role assignments to minimize exposure. Monitor for updates from the vendor regarding patches or official fixes.
CVE-2026-13167: CWE-862 Missing Authorization in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Description
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13167 describes an authorization bypass vulnerability in the Everest Forms plugin for WordPress, affecting all versions up to and including 3.5.2. The plugin fails to properly verify that a user is authorized to perform plugin activation actions. As a result, authenticated users with delegated Everest Forms capabilities (such as manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms) can activate arbitrary installed WordPress plugins without requiring the core activate_plugins capability. The plugin's roles and permissions system allows administrators to assign these delegated capabilities to non-administrator roles like Author. The AJAX handlers involved emit nonces on admin pages accessible to such delegated users, facilitating exploitation. This vulnerability is categorized under CWE-862 (Missing Authorization).
Potential Impact
The vulnerability allows authenticated users with delegated Everest Forms permissions to activate any installed WordPress plugin, including previously deactivated or vulnerable plugins, without holding the standard activate_plugins capability. This can lead to integrity impact by enabling unauthorized changes to the WordPress environment. There is no direct confidentiality or availability impact reported. The CVSS score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring privileges but no user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated Everest Forms capabilities to trusted users only and review role assignments to minimize exposure. Monitor for updates from the vendor regarding patches or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-24T13:20:44.511Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a813f86bf8831d539784a7d
Added to database: 08/16/2026, 04:41:42 UTC
Last enriched: 08/16/2026, 04:57:33 UTC
Last updated: 08/16/2026, 15:30:18 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.