Critical Vulnerability in Everest Forms WordPress Plugin Allows Complete Site Takeover

A critical vulnerability, identified as CVE-2026-19598 and carrying a CVSS score of 9.8, has been discovered in the widely used Everest Forms WordPress plugin. This flaw exposes over 100,000 websites to complete site takeover by unauthenticated attackers. The vulnerability resides within the plugin's file-upload handling logic, specifically in the EVF_Form_Fields_Upload class, and affects all versions prior to 3.0.9.5.

Exploitation of this vulnerability allows threat actors to upload arbitrary files, including malicious PHP scripts, which can then be executed by the web server. This capability grants attackers the ability to establish a remote code execution (RCE) foothold on the affected WordPress site. Crucially, an attacker does not require any form of authentication or a valid WordPress account to leverage this vulnerability, making it accessible to a broad range of malicious actors.

The potential impact of a successful exploit extends far beyond simple website defacement. With RCE, attackers can gain deep access to the site's backend. This includes the ability to steal sensitive database credentials by accessing the WordPress configuration file (wp-config.php), create new administrator accounts to maintain persistent access, modify or inject malicious code into themes and plugins, and insert harmful JavaScript into pages viewed by site visitors. This can transform a compromised website into a distribution point for phishing campaigns, malware, SEO spam, or credential harvesting operations.

Furthermore, the vulnerability may also permit arbitrary file deletion. Attackers could potentially remove critical files such as wp-config.php. The deletion of this file can revert a WordPress installation to its initial setup mode, creating another avenue for attackers to connect the site to an attacker-controlled database and seize complete ownership of the web environment. This highlights the severity and multifaceted nature of the risks posed by CVE-2026-19598.

Security researchers at Wordfence, who detailed the vulnerability, have implemented protections within their firewall to block exploitation attempts. However, they strongly advise all website administrators to take immediate action to secure their sites. The primary recommendation is to update the Everest Forms plugin to version 3.0.9.5 or a later release as soon as possible.

For websites where an immediate update is not feasible, administrators are urged to temporarily disable the Everest Forms plugin, particularly if it features public file-upload forms. This temporary measure can mitigate the risk of exploitation while a patch is applied. Beyond patching, a thorough investigation for signs of compromise is essential for any site running a vulnerable version.

Security teams should conduct a comprehensive review of their WordPress installations. This includes scrutinizing administrator accounts for any unauthorized users, inspecting upload directories for recently added PHP files, and analyzing web server logs for suspicious requests targeting the Everest Forms upload endpoints. Indicators of compromise can also include newly modified plugin or theme files, obfuscated PHP code, unexpected scheduled tasks, or unusual outbound network connections.

In the event of a suspected compromise, organizations must act decisively. This involves rotating all associated credentials, including WordPress, database, hosting panel, FTP, SSH, and API keys. Affected files should be restored from a known-good backup, any unauthorized administrator accounts must be removed, and a complete audit of plugins, themes, scheduled jobs, and server-side persistence mechanisms should be performed to ensure the environment is clean and secure.