8
CVEs
2
Critical
0
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
0
MEDIUM
6
LOW
0
Monthly CVE Trend
Affected Products (12)
Wordpress Plugin
35
PHP
17
Everest Forms
14
User Registration
12
User Registration Membership
8
User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder
6
Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder
2
Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder With Ai
2
Open Redirect
1
Everest Forms Pro
1
User Registration Membership Pro
1
Pdfdraft Drag Drop Pdf Builder Pdf Viewer Embed Download Pdf Certificate Invoice Designer
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74001 | Account takeover in the WPEverest User Registration & Membership Pro WordPress plugin (versions 5.4.5 and earlier) lets remote unauthenticated attackers bypass the plugin's authentication logic (CWE-288) and gain control of arbitrary user accounts, including administrators. Reported by Patchstack and rated CVSS 9.8, the flaw requires no privileges or user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-62103 | Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-1869 | Payment bypass in WPEverest's User Registration & Membership WordPress plugin (versions up to and including 5.2.0) allows unauthenticated remote attackers to activate paid memberships without completing payment. The vulnerability stems from missing authorization checks in the confirm_payment() function (CWE-862), which fails to validate that a legitimate payment transaction occurred before granting membership access. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity and requires no authentication, making it trivially reachable by any internet-connected adversary. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-73995 | Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.4 | 0.3% | 27 |
No patch
|
| CVE-2026-73403 | Broken access control in the WPEverest User Registration WordPress plugin (versions ≤5.2.6) permits unauthenticated remote attackers to bypass authorization checks and perform unauthorized actions within the registration subsystem, yielding limited integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no authentication, no user interaction, and no special configuration, though impact is constrained to integrity modifications with no confidentiality or availability effect. No public exploit code and no active exploitation have been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-12124 | Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with `__return_true`, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-5096 | Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|
| CVE-2026-13167 | Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation. | MEDIUM | 4.3 | 0.3% | 22 |
No patch
|