The vulnerability in the Everest Forms plugin for WordPress permits unauthenticated attackers to extract any WordPress post meta value, such as license keys, API tokens, SMTP credentials, and Stripe or AWS secrets, by submitting a form. Sensitive data is sent via form submission notification emails or stored entries, and the form’s nonce is publicly rendered, allowing attackers to forge it through the nopriv everest_forms_get_form_update_nonce action. The exploit requires no user authentication and can be performed by any internet user who can access the form.

All installations of the Everest Forms plugin up to and including version 3.6.2 are affected. The vulnerability exists across the contact, payment, quiz, survey, and custom form builder features provided by the wpeverest product line.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild so far. However, because the attack does not require authentication and the form nonce is publicly exposed, the practical risk of sensitive data leakage is significant. Attackers could easily trigger the submission process to obtain and reuse private credentials, potentially leading to account compromise or fraudulent transactions.