Everest Forms EUVD-2026-42508

Exploitation requires that the target site uses Everest Forms (before 3.5.0) with email-notification processing that generates the temporary CSV files, and that those files remain in the publicly served wp-content/uploads directory. No special conditions on the attacker side - no authentication, no user interaction, and network access to the site suffice (AV:N/AC:L/PR:N/UI:N). Limiting factors: sites that do not use CSV-generating email notifications, or that have already had their temp files cleaned/removed, will have little or nothing to expose; server-side rules blocking direct access to uploads would also prevent retrieval. The attacker must still enumerate/predict the filename, though the description confirms these names are predictable and enumerable, keeping complexity low.

The signals are largely consistent and point to a genuine but moderate real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5 High) reflects trivially remote, unauthenticated access with confidentiality-only impact - no integrity or availability effect, matching an information-disclosure bug. SSVC corroborates this: exploitation status 'poc', automatable 'yes' (filenames are enumerable, so retrieval can be scripted at scale), and technical impact 'partial'. The main tempering signal is EPSS at 0.14% (4th percentile), indicating low observed/predicted exploitation volume, and the absence from CISA KEV means no confirmed active exploitation. The low EPSS despite public POC is not contradictory - it reflects that broad mass-exploitation has not (yet) been observed, not that the bug is hard to trigger. Practical risk depends heavily on whether a given site actually uses email notifications that generate CSV attachments and whether sensitive PII flows through those forms; where it does, the impact (leak of arbitrary users' submissions) is significant.

An attacker identifies a WordPress site running a vulnerable Everest Forms version and scripts requests against the uploads directory, iterating over the predictable CSV filename pattern. Because retrieval requires no authentication or user interaction, each successful guess returns another user's form submission data (names, emails, and any other collected fields). Public exploit code from WPScan lowers the effort, and the automatable nature allows harvesting across many sites.