EUVD-2026-42511
GHSA-v4gv-5wcc-cjvx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST API requires no credentials; impact confined to partial config read and write plus email triggering, with no availability or scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
AnalysisAI
Unauthenticated remote attackers can completely bypass access controls on Everest Forms REST API endpoints in all plugin versions before 3.5.0, enabling them to read onboarding status data, modify plugin settings, and send emails from the WordPress site to arbitrary addresses. The flaw arises because the capability check is conditioned on an attacker-controllable HTTP request header - omitting or altering that header disables the authorization gate entirely. A publicly available proof-of-concept exploit exists, and SSVC assessment confirms the attack is automatable; however, this vulnerability is not in CISA KEV, and EPSS sits at 0.14%, suggesting limited observed exploitation despite the low barrier to entry.
Technical ContextAI
Everest Forms is a WordPress form-builder plugin that exposes multiple REST API endpoints for its onboarding assistant feature. The authorization logic is critically flawed: rather than unconditionally checking caller capabilities, the guard is only triggered when a specific HTTP request header supplied by the client holds a particular value. An attacker who omits or modifies that header bypasses the check entirely, reaching protected endpoints without any authentication. The affected CPE is cpe:2.3:a:unknown:everest_forms:*:*:*:*:*:*:*:* covering versions up to (not including) 3.5.0. No CWE was formally assigned, but the root cause aligns with CWE-862 (Missing Authorization) or CWE-863 (Incorrect Authorization) - the guard exists but its activation condition is attacker-controlled, making it trivially circumvented. Reported by WPScan and tracked under EUVD-2026-42511.
RemediationAI
Update Everest Forms to version 3.5.0 or later; this is the vendor-released patch that corrects the broken authorization logic. If immediate upgrade is not feasible, consider restricting unauthenticated access to WordPress REST API routes associated with the Everest Forms onboarding assistant (e.g., paths matching /wp-json/everest-forms/v1/onboarding or equivalent) at the web server or WAF layer - note that blanket REST API blocking may break other plugin or theme functionality, so scoping to the specific onboarding routes is preferable. Alternatively, temporarily deactivating the Everest Forms plugin eliminates the attack surface entirely at the cost of all form functionality. WPScan advisory details including affected endpoint paths are available at https://wpscan.com/vulnerability/30813664-2af7-45da-b37c-3d573bc80bd9/.
More in Everest Forms
View allInformation disclosure in the Everest Forms WordPress plugin before 3.5.0 allows unauthenticated remote attackers to dow
The Everest Forms - Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
The Everest Forms - Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter befo
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and in
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Rated critical sever
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow h
The Everest Forms (Pro) WordPress plugin versions up to 1.9.4 contain an arbitrary file deletion vulnerability in the de
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow h
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including
The Everest Forms - Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is
Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today