The vulnerability is an insecure direct object reference found in the get_entry functionality of the Everest Forms plugin for WordPress, up to version 3.6.2. An attacker who has authenticated credentials at the custom-level or higher can supply arbitrary identifiers to the JSON‑RPC /tools/call endpoint and retrieve or delete any form or entry, including personally identifiable information, without regard to the original form owner. This permits confidentiality compromise of sensitive user data and integrity loss as well as the potential for denial of service by removing legitimate entries.

The affected product is the WordPress plugin Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI, versions up to and including 3.6.2. The vulnerability is not tied to a specific WordPress core version, but applies to any site running the plugin within the stated range.

The CVSS score of 6.5 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV. The attack requires the attacker to be authenticated and possess user roles of custom+ or higher. Once credentials are obtained or standard site permissions are exploited, the attacker can invoke the vulnerable endpoint to read or delete arbitrary objects, with no network boundary constraints other than the WordPress site itself.