Everest Forms CVE-2026-12270

The target WordPress site must have the Everest Forms plugin installed and active in a version from 3.4.2 up to (not including) 3.5.0. The WordPress REST API must be publicly reachable, which is the default configuration for virtually all WordPress installations. No authentication, no user interaction, and no special plugin configuration are required - the CVSS vector PR:N/UI:N/AC:L confirms zero-barrier unauthenticated exploitation against default deployments. Exploitation is bounded to the onboarding assistant REST API endpoints only; it does not grant full administrative access, does not affect WordPress core or other plugins, and cannot directly compromise the database or filesystem. The practical ceiling of impact is reading onboarding status, modifying Everest Forms-specific plugin options, and sending arbitrary outbound email from the site.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects easy network exploitation with no authentication, but correctly scores limited impact - partial read and write, no availability or scope change. EPSS at 0.14% (4th percentile) indicates very low observed exploitation probability despite POC availability, suggesting that while the attack is trivial, the payoff is modest enough to deter widespread opportunistic exploitation. That said, SSVC rates the attack as automatable with POC-level exploitation, which diverges from the benign EPSS signal - this gap likely reflects that mass exploitation is feasible but not yet occurring at scale. The ability to trigger outbound email to arbitrary addresses introduces reputational risk (spam and phishing abuse from legitimate domains) that raw CVSS impact metrics do not fully capture. Overall: low-to-medium real-world priority for most organizations, but the automatable POC and trivial bypass mechanism warrant prompt patching for any site running the affected plugin. No data conflicts identified; CVSS vector and description are mutually consistent.

An unauthenticated attacker sends HTTP requests to Everest Forms onboarding REST API endpoints while deliberately omitting or modifying the header value that normally activates the capability check, causing the authorization gate to be skipped entirely. The attacker reads onboarding configuration data, modifies plugin options to alter site behavior, and triggers outbound email from the WordPress site to an attacker-chosen address - enabling phishing or spam campaigns using the site's legitimate domain and mail infrastructure. A publicly available proof-of-concept demonstrates this technique, and the attack is rated automatable by SSVC, making scripted mass scanning feasible.