Is CVE-2026-91153 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91153 being exploited in the wild.

How severe is CVE-2026-91153?

Medium severity, with a CVSS score of 5.3, published 29 October 2026.

Which products and versions are affected?

ThemeGrill Everest Forms up to and including 3.6.2.

How is CVE-2026-91153 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91153?

Check whether you run ThemeGrill Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91153: Everest Forms sensitive information exposure via smart tag injection

CVE-2026-91153 · Severity: medium · CVSS 5.3 · Published 2026-10-29

Everest Forms is a WordPress plugin for building contact forms, surveys, and payment forms. The plugin exposes sensitive WordPress data—such as API tokens, SMTP credentials, and payment secrets—to unauthenticated attackers through form submissions. An attacker can extract any WordPress post metadata by injecting specially crafted form submissions without requiring any account or prior access.

Vendors: ThemeGrill.

Quick answers

Is CVE-2026-91153 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91153 being exploited in the wild.
How severe is CVE-2026-91153?: Medium severity, with a CVSS score of 5.3, published 29 October 2026.
Which products and versions are affected?: ThemeGrill Everest Forms up to and including 3.6.2.
Is there a fix for CVE-2026-91153?: A patch was published on 2026-10-12: Fix merged in PR #1669 on Oct 12, 2026; hardening of smart tag resolution to process only admin-configured default values, not submitted values Until you apply it: Restrict access to sensitive post metadata or disable the plugin until an updated version is available. Review WordPress post metadata storage to identify exposed credentials and rotate any compromised API tokens, SMTP passwords, and payment gateway secrets. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91153 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91153?: Check whether you run ThemeGrill Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict access to sensitive post metadata or disable the plugin until an updated version is available. Review WordPress post metadata storage to identify exposed credentials and rotate any compromised API tokens, SMTP passwords, and payment gateway secrets.

Technical details

The vulnerability is a post-submission smart tag injection in the form processing logic. The plugin improperly processes smart tags like {post_meta key=...} from user-submitted form data, allowing attackers to inject arbitrary smart tags that resolve to sensitive post metadata. Unauthenticated attackers can exploit this by manipulating form submission parameters; the vulnerability requires no authentication and leverages publicly available nonces or nonces that can be generated anonymously via the everest_forms_get_form_update_nonce action.

Affected products

ThemeGrill Everest Forms up to and including 3.6.2

Timeline

2026-10-29: disclosed
2026-10-12: patched: Fix merged in PR #1669 on Oct 12, 2026; hardening of smart tag resolution to process only admin-configured default values, not submitted values

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.