Critical WordPress Plugin Vulnerability Exposes 100,000 Sites

Key Takeaways

• A critical vulnerability, CVE-2026-19598, has been identified in the Everest Forms WordPress plugin.
• Over 100,000 websites are at risk of complete compromise due to this flaw.
• The vulnerability allows unauthenticated attackers to upload malicious files and execute remote code.
• A patch is available; users should update to Everest Forms version 3.0.9.5 or higher immediately.

Critical Flaw in Everest Forms Plugin Threatens WordPress Sites

A severe security vulnerability in the Everest Forms WordPress plugin, tracked as CVE-2026-19598, has put more than 100,000 websites at risk of full site takeover. This critical flaw carries a CVSS severity score of 9.8, indicating its extreme potential for exploitation.

The vulnerability enables attackers to upload malicious files without authentication, leading to remote code execution and potentially granting them complete control over affected WordPress installations.

Technical Details of the Vulnerability

As detailed by security researchers at Wordfence, the flaw impacts Everest Forms versions preceding 3.0.9.5. The root cause lies within the plugin’s file-upload handling logic, specifically within the EVF_Form_Fields_Upload class. Insufficient validation of both file types and designated upload paths allows malicious actors to upload arbitrary files, including executable PHP scripts, which the web server may then process.

Exploitation Path and Impact

Exploitation of this vulnerability does not require any prior authentication or a valid WordPress account. An attacker can craft specific requests targeting a vulnerable file-upload feature within a form, enabling them to plant a malicious PHP web shell directly onto the server. A web shell provides a remote interface, allowing threat actors to execute commands, navigate file systems, exfiltrate databases, alter website content, or deploy additional malware.

The consequences of such a compromise extend far beyond simple website defacement. With remote code execution capabilities, attackers can gain access to critical WordPress configuration files, extract sensitive database credentials, create unauthorized administrator accounts, manipulate themes and plugins, and inject malicious JavaScript into user-facing pages. This level of control can transform a compromised website into a launchpad for phishing campaigns, malware distribution, SEO spam, credential harvesting, or attacks against site visitors.

The vulnerability also presents a risk of arbitrary file deletion. Attackers could remove vital WordPress files, such as wp-config.php, which stores essential database connection details. Deleting this file could force the WordPress instance into an installation mode, creating an alternative pathway for attackers to link the site to their own database and seize ownership of the entire environment, as reads the Wordfence report.

What You Should Do

• Update Immediately: Website administrators must update the Everest Forms plugin to version 3.0.9.5 or later without delay.
• Disable if Unpatchable: If immediate patching is not feasible, temporarily deactivate the Everest Forms plugin, especially if your site utilizes public file-upload forms.
• Investigate for Compromise: Review WordPress administrator accounts for any unauthorized users. Scrutinize upload directories for recently created or suspicious PHP files. Examine web server logs for unusual requests targeting Everest Forms upload endpoints.
• Look for IoCs: Be vigilant for indicators of compromise such as newly modified plugin or theme files, obfuscated PHP code, unknown scheduled tasks, or unexpected outbound network connections.
• Post-Compromise Actions: If a compromise is suspected, immediately rotate all WordPress, database, hosting panel, FTP, SSH, and API credentials. Restore affected files from a verified clean backup, remove any unauthorized administrator accounts, and conduct a thorough audit of all plugins, themes, scheduled jobs, and server-side persistence mechanisms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.