Critical Everest Forms WordPress Plugin Vulnerability Exposes 100,000+ Sites to Takeover A severe vulnerability (CVE-2026-19598) in the Everest Forms WordPress plugin has left over 100,000 websites vulnerable to complete site takeover via unauthenticated remote code execution (RCE). The flaw, rated 9.8 on the CVSS scale, stems from inadequate file-type and path validation in the plugin’s `EVF_Form_Fields_Upload` class, affecting versions prior to 3.0.9.5. Attackers can exploit the vulnerability by submitting maliciously crafted requests to the plugin’s file-upload feature, allowing them to upload arbitrary files including PHP web shells without requiring valid WordPress credentials. Once deployed, a web shell grants attackers full remote control, enabling them to execute commands, steal databases, modify site content, or inject malicious JavaScript into visitor-facing pages. The impact extends beyond defacement: threat actors can extract database credentials, create unauthorized administrator accounts, alter themes/plugins, or delete critical files like `wp-config.php`, potentially forcing a WordPress site into installation mode and hijacking its database. Compromised sites may also be repurposed for phishing, malware distribution, SEO spam, or credential theft. Security firm Wordfence reported the issue and confirmed its firewall blocks exploitation attempts. Administrators are urged to update to Everest Forms 3.0.9.5 or later immediately. Those unable to patch should disable the plugin, particularly if public file-upload forms are in use. Indicators of compromise include unauthorized admin accounts, suspicious PHP files in upload directories, or unusual log activity targeting Everest Forms endpoints. Suspected breaches warrant credential rotation, backup restoration, and a full review of plugins, themes, and server-side persistence mechanisms.