WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks
ID: 7e8cae04-3ef3-53ab-95ee-2b8d69cf38a8
STIX ID: report--7e8cae04-3ef3-53ab-95ee-2b8d69cf38a8
Feed Name: cybersecurityNews.com
Threat Score
A critical CVE-2026-19598 in the Everest Forms WordPress plugin (pre-3.0.9.5) enables unauthenticated arbitrary file uploads and remote code execution via flawed upload handling (EVF_Form_Fields_Upload), potentially affecting over 100,000 sites; site owners are advised to update immediately, disable the plugin if patching is not possible, and investigate for web shells, unauthorized admin accounts, modified files, and suspicious logs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.