Somewhere right now, a WordPress "Contact Us" form is quietly accepting résumés, RSVPs, and — thanks to a very bad bug — arbitrary PHP web shells from total strangers. Nothing says "please reach out anytime" quite like an open invitation for a hacker to move in.

100,000 Sites, One Very Leaky Upload Field

Researchers disclosed CVE-2026-19598, a critical (9.8 out of 10!) flaw in Everest Forms, a WordPress form-builder plugin running on more than 100,000 sites. The bug lives in the plugin's file-upload handling, which fails to properly validate what type of file is actually being uploaded.

Translation: an attacker doesn't need a username, a password, or even a "pretty please." They can send a specially crafted request straight to a public upload field and drop a PHP web shell onto the server — no login required. From there it's game over: database credentials, new admin accounts, deleted core files, the whole buffet. Anyone running a version before 3.0.9.5 is exposed.

Why "Just a Plugin" Never Means Just a Plugin

This is the part that trips people up: nobody thinks of a form plugin as their site's weakest link, because it's not the flashy part. It's the boring utility everyone installed once and forgot about. That's exactly why attackers love it — boring, ubiquitous software is a bigger target than any single flashy CMS core.

And the math is brutal at scale: one vulnerable plugin times 100,000 installs equals a genuinely massive attack surface, all from a feature (file uploads) that most site owners never think twice about.

The fix is a two-minute update. The fallout from skipping it is not.

If you're not sure which of your site's plugins are quietly one bad upload field away from disaster, our free developer security checklist walks through exactly what to audit: grab the guide here.

Source: Cyber Security News