CVE-2025-3422: Everest Forms Arbitrary Shortcode Execution

CVE-2025-3422 Overview

The Everest Forms WordPress plugin contains an arbitrary shortcode execution vulnerability affecting all versions up to and including 3.1.1. The plugin, marketed as a Contact Form, Quiz, Survey, Newsletter and Payment Form Builder, fails to validate a user-supplied value before passing it to WordPress's do_shortcode function. Authenticated attackers with Subscriber-level access or higher can execute arbitrary shortcodes on affected sites. The flaw is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Subscriber-level users can trigger arbitrary shortcodes, enabling abuse of any installed plugin or theme shortcode to expose data, alter content, or pivot to further attacks.

Affected Products

Everest Forms plugin for WordPress, all versions through 3.1.1
WordPress sites running the vulnerable plugin with open user registration (Subscriber role)
WordPress sites where Subscriber-or-higher accounts can be obtained by attackers

Discovery Timeline

2025-04-11 - CVE-2025-3422 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-3422

Vulnerability Analysis

Everest Forms exposes an action handler that accepts a value from the request and forwards it into do_shortcode without validating the source or contents. WordPress's do_shortcode parses and executes any registered shortcode present in the supplied string. Because the plugin performs only a Subscriber-level capability check, any authenticated low-privilege user can invoke the handler.

Exploitation impact depends on the shortcodes registered by the target site's plugins and theme. Attackers can render restricted content, trigger administrative shortcode side effects, or use shortcodes that emit sensitive data. On sites that combine this issue with vulnerable third-party shortcodes, the effect can escalate to information disclosure or content manipulation across the whole installation.

Root Cause

The root cause is missing input validation before invoking do_shortcode. The handler treats an attacker-controlled parameter as trusted shortcode markup. There is no allowlist of permitted shortcodes and no verification that the requesting user should be able to execute the requested shortcode.

Attack Vector

The attack is delivered over the network against the WordPress AJAX or admin-post endpoint exposed by the plugin. The attacker authenticates as any user with Subscriber role or higher, then issues a crafted request containing arbitrary shortcode markup in the vulnerable parameter. No user interaction from an administrator is required.

See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the patched code path.

Detection Methods for CVE-2025-3422

Indicators of Compromise

POST requests from Subscriber-level accounts to Everest Forms AJAX or admin-post actions containing raw shortcode syntax such as [...] in body parameters.
Web server logs showing repeated requests to the vulnerable endpoint from a single low-privilege account.
Unexpected rendering of privileged content or plugin output in HTTP responses to Subscriber sessions.

Detection Strategies

Inspect access logs for Subscriber accounts issuing requests to admin-ajax.php or admin-post.php targeting Everest Forms actions with parameter values containing bracketed shortcode tags.
Enable WordPress debug logging or an audit plugin to record do_shortcode invocations tied to non-administrator sessions.
Correlate new Subscriber account registrations with subsequent requests to Everest Forms endpoints within short time windows.

Monitoring Recommendations

Alert on unusual volumes of authenticated requests to Everest Forms endpoints, especially from newly created accounts.
Monitor for shortcode strings such as [gallery ...], [wp_...], or plugin-specific shortcodes appearing inside POST bodies to plugin AJAX actions.
Track privilege distribution changes and outbound data volumes from WordPress hosts to detect misuse of shortcodes that expose data.

How to Mitigate CVE-2025-3422

Immediate Actions Required

Update Everest Forms to a version later than 3.1.1 that includes the fix from changeset 3268742.
Disable open user registration or restrict the default new-user role to a capability lower than Subscriber where feasible.
Audit existing Subscriber and higher accounts and remove any that are unrecognized or inactive.

Patch Information

The vendor addressed the issue in the Everest Forms plugin through the code update in WordPress Plugin Changeset 3268742. The patch adds validation around the value passed to do_shortcode, blocking arbitrary shortcode execution by low-privilege users. Site owners should upgrade to the fixed release published on wordpress.org and confirm the plugin version reported in the admin dashboard.

Workarounds

Temporarily deactivate the Everest Forms plugin until the patched version is installed.
Restrict access to admin-ajax.php and admin-post.php endpoints for the plugin using a web application firewall rule that blocks bracketed shortcode syntax in the vulnerable parameter.
Remove the Subscriber role from all non-essential accounts and enforce strong authentication on remaining user accounts.

bash

# WP-CLI: update the plugin and verify the installed version
wp plugin update everest-forms
wp plugin get everest-forms --field=version