EUVD-2026-42508
GHSA-32jc-cm64-7hx3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote HTTP retrieval of enumerable files (AV:N/AC:L/PR:N/UI:N) with sensitive-data disclosure only, so C:H and I/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.
AnalysisAI
Information disclosure in the Everest Forms WordPress plugin before 3.5.0 allows unauthenticated remote attackers to download other users' form submissions. The plugin generates temporary CSV files during email-notification processing but fails to reliably delete them, leaving them publicly accessible in the wp-content uploads directory under predictable, enumerable filenames. Publicly available exploit code exists and the flaw is automatable per CISA SSVC, though EPSS remains low at 0.14%; not listed in CISA KEV.
Technical ContextAI
Everest Forms is a drag-and-drop form-builder plugin for WordPress used to collect submissions such as contact, registration, and survey data. When a form triggers an email notification, the plugin serializes submission data into a temporary CSV file (commonly attached to the notification email) written into the web-accessible wp-content/uploads directory. The vulnerability is an insufficient-cleanup / insecure-storage issue (aligning with CWE-200 Exposure of Sensitive Information and CWE-459 Incomplete Cleanup, though the input lists CWE as N/A): the temp files are not reliably removed after use and their names follow a predictable, enumerable pattern, so an attacker who guesses or enumerates the URL can fetch files directly over HTTP without any WordPress authentication. Because the uploads directory is served statically by the web server, no plugin code path or access control mediates retrieval.
RemediationAI
Vendor-released patch: upgrade Everest Forms to version 3.5.0 or later, which corrects the temporary-file cleanup and storage behavior; this is the primary and recommended fix (advisory: https://wpscan.com/vulnerability/4bd381e9-2f4e-4e61-99af-88f50aed71f5/). If immediate upgrade is not possible, apply compensating controls: block direct HTTP access to CSV files under wp-content/uploads via a web-server rule (e.g. deny requests matching the plugin's temp CSV path/extension in nginx or .htaccess), which stops enumeration but may break legitimate CSV export/attachment links if any are served from that path; manually delete leftover CSV files already present in the uploads directory to remove currently-exposed data; and, where feasible, disable email-notification actions that generate CSV attachments until patched, at the cost of losing those notifications. After patching, audit uploads for residual exposed files and treat any previously leaked submissions as potentially compromised.
More in Everest Forms
View allThe Everest Forms - Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
The Everest Forms - Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
Unauthenticated remote attackers can completely bypass access controls on Everest Forms REST API endpoints in all plugin
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter befo
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and in
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Rated critical sever
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow h
The Everest Forms (Pro) WordPress plugin versions up to 1.9.4 contain an arbitrary file deletion vulnerability in the de
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow h
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including
The Everest Forms - Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today