Everest Forms, a popular WordPress plugin used by more than 100,000 websites to build contact and order forms, has been hit by a critical new vulnerability. Tracked as CVE-2026-19598, the flaw lets unauthenticated attackers upload arbitrary files and take full control of an affected site — a CVSS score of 9.8 puts it among the most severe issues the WordPress community has faced this year.
What exactly is broken
The vulnerability lies in the file upload feature built into Everest Forms. Because uploaded files aren’t properly validated for type or content, an attacker can upload a malicious PHP script straight to the server without ever logging in. Once the file is there, running it is as simple as opening a direct link — giving the attacker the same power as a site administrator. In practice that means deleting content, defacing the site, sending spam, or using the site as a launchpad for further attacks.
Who is at risk
Data suggests tens of thousands of active installations are still running the vulnerable version. Every site using Everest Forms that hasn’t updated to version 3.0.9.5 or later is exposed. The risk is compounded by the fact that forms are usually placed right on the homepage, so attackers don’t need to find any hidden entry point — the same form your visitors fill out every day is the vulnerability.
Why these flaws keep happening
Form plugins have long been one of the riskiest parts of the WordPress ecosystem, since by design they accept data from unknown, untrusted users — and file uploads are among the most sensitive features a plugin can offer. Earlier this year, competitor Forminator faced a nearly identical scenario, exposing over 300,000 sites. The pattern repeats: a widely used tool, a file upload feature, and one missing check is all it takes to turn an everyday form into an attacker’s front door.
What to do right now
If your site uses Everest Forms, check the plugin version in your dashboard and update to 3.0.9.5 or later immediately. If automatic updates aren’t enabled, update manually without delay — for a flaw this severe, it’s a matter of days, not weeks, before exploitation attempts appear. We also recommend checking your uploads folder for anything you didn’t put there yourself, and reviewing recent site logs for unusual activity.
Conclusion
Critical vulnerabilities in form plugins have become almost routine in 2026, and Everest Forms is just the latest example of how quickly a everyday website component can turn into a security risk. Don’t want to track plugin versions and security advisories yourself? Get in touch and we’ll set up ongoing management and monitoring so you don’t have to keep chasing the news.
