CVE-2026-13167 is an authorization bypass vulnerability in the Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI WordPress plugin. Versions up to and including 3.5.2 do not properly verify that a user is authorized to perform plugin activation actions. As a result, authenticated users with delegated Everest Forms capabilities (such as manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms) can activate arbitrary already-installed WordPress plugins, including previously deactivated or vulnerable ones, without requiring the core activate_plugins capability. The plugin's roles and permissions system allows these delegated capabilities to be assigned to non-administrator roles like Author. The AJAX handlers involved emit nonces on admin pages accessible to such delegated users, facilitating exploitation.

An attacker with delegated Everest Forms permissions can activate arbitrary WordPress plugins without holding the standard activate_plugins capability. This could lead to enabling vulnerable or malicious plugins, potentially increasing the attack surface or enabling further compromise. The vulnerability does not directly disclose data or cause denial of service but allows privilege escalation within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated Everest Forms capabilities to trusted users only and review role assignments to minimize exposure. Monitor for updates from the vendor regarding a patch or official mitigation.