WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks

A critical vulnerability tracked as CVE-2026-19598 in the Everest Forms WordPress plugin has exposed more than 100,000 websites to complete site takeover attacks.

The flaw has a CVSS severity score of 9.8. It can allow unauthenticated attackers to upload malicious files, execute code remotely, and potentially gain full control of affected WordPress sites.

The vulnerability detailed by Wordfence affects Everest Forms versions before 3.0.9.5. It exists in the plugin’s file-upload handling logic, specifically in the EVF_Form_Fields_Upload class.

Insufficient validation of file types and paths can enable attackers to upload arbitrary files, including PHP scripts that the web server may execute.

WordPress Plugin Vulnerability Exposed

An attacker does not need a valid WordPress account to exploit the issue. By targeting a vulnerable form-upload feature with specially crafted requests, a threat actor could place a malicious PHP web shell on the server.

A web shell provides attackers with a remote interface to run commands, browse files, steal databases, modify site content, or install additional malware.

The impact can extend beyond defacing a website. Attackers with remote code execution can access the WordPress configuration file, extract database credentials, create administrator accounts, modify themes and plugins, and insert malicious JavaScript into visitor-facing pages.

This can turn a compromised website into a platform for phishing, malware delivery, SEO spam, credential theft, or attacks against site visitors.

The issue may also enable arbitrary file deletion. Attackers could remove important WordPress files, including wp-config.php, which stores database connection details.

Deleting this file may place a WordPress instance into installation mode, creating another path for attackers to connect the site to an attacker-controlled database and take ownership of the environment, reads the Wordfence report.

Website administrators should immediately update Everest Forms to version 3.0.9.5 or later. Sites that cannot be patched quickly should temporarily turn off the plugin, especially if it uses public file-upload forms.

Administrators should also investigate for signs of compromise. Security teams should review WordPress administrator accounts for unauthorized users, inspect upload directories for recently created PHP files, and examine web logs for suspicious requests targeting Everest Forms upload endpoints.

Newly modified plugin or theme files, obfuscated PHP code, unknown scheduled tasks, and unexpected outbound connections should be treated as potential indicators of compromise.

If compromise is suspected, organizations should rotate WordPress, database, hosting-panel, FTP, SSH, and API credentials. They should restore affected files from a known-good backup, remove unauthorized administrator accounts, and perform a full review of plugins, themes, scheduled jobs, and server-side persistence mechanisms.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks appeared first on Cyber Security News.