CVE-2026-11571: Everest Forms Undeleted CSV Files Expose Form Submission Data

Technical summary

CVE-2026-11571 is an information disclosure vulnerability in Everest Forms WordPress plugin versions prior to 3.5.0. The plugin generates temporary CSV files during email-notification workflows but does not reliably delete them after use. These files persist in the web-accessible uploads directory with enumerable filenames, enabling unauthenticated attackers to discover and retrieve CSV exports containing form submission records. The vulnerability stems from insufficient file lifecycle management and the absence of access controls on temporary artifacts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects high confidentiality impact with network-based, low-complexity exploitation requiring no privileges or user interaction.

Business impact

Form submissions often contain personally identifiable information (names, email addresses, phone numbers), financial details, or other sensitive customer data. Unauthorized disclosure via CSV file enumeration undermines customer trust, creates compliance liabilities under GDPR, CCPA, and similar regulations, and may expose your organization to breach notification obligations and financial penalties. For SaaS providers and agencies using Everest Forms on client sites, the risk extends across multiple customer environments.

Affected systems

WordPress installations running Everest Forms plugin versions before 3.5.0 are affected. The vulnerability impacts all sites using this plugin regardless of configuration, though sites processing sensitive form data face higher business risk. No user role, plugin settings, or hosting environment provides protection; the flaw is present in all vulnerable versions.

Exploitability

Exploitation is straightforward: attackers do not need authentication, valid user accounts, or special tooling—only knowledge that the site runs Everest Forms and the ability to predict or enumerate temporary CSV filenames in the uploads directory. The attack can be automated at scale. No user interaction or social engineering is required. The primary barrier to exploitation is discovering which sites use this plugin, but this can be determined through standard WordPress enumeration techniques.

Remediation

Upgrade Everest Forms to version 3.5.0 or later. This patch version includes fixes for reliable deletion of temporary CSV files. After patching, manually inspect your uploads directory for any orphaned CSV files and remove them. If you have not already done so, consider implementing web server access controls (e.g., .htaccess rules or firewall policies) to restrict direct access to the uploads directory, and audit recent access logs for suspicious enumeration patterns.

Patch guidance

Update Everest Forms from the WordPress plugin repository to version 3.5.0 or newer. Verify the plugin version in your WordPress dashboard under Plugins. If automatic updates are not enabled, manually download the latest version and test it in a staging environment before applying to production. Document the update date and version for your change log. After upgrading, confirm that form email notifications continue to function correctly and that no temporary files persist after notifications are sent.

Detection guidance

Check your WordPress plugins list for Everest Forms and confirm the version number is 3.5.0 or higher. Review your uploads directory (typically wp-content/uploads/) for CSV files with suspicious naming patterns or creation dates; these may indicate successful exploitation or exploitation attempts. Monitor web server access logs for unusual patterns of requests to the uploads directory, particularly those attempting to enumerate or list files. Configure WordPress security monitoring or WAF rules to alert on repeated failed file access attempts to the uploads directory.

Why prioritize this

This vulnerability merits urgent patching because it enables unauthenticated remote information disclosure of potentially sensitive customer data with no exploitation barriers. The high CVSS score (7.5) reflects the severity of confidentiality impact. While not yet on the CISA Known Exploited Vulnerabilities catalog, the simplicity of exploitation and clear value of the exposed data make active exploitation likely in the near term. Organizations processing PII through Everest Forms should treat this as a critical update.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is assigned due to: (1) network-accessible attack vector requiring no authentication or privileges; (2) low attack complexity with no special conditions; (3) high confidentiality impact (direct access to form submission records); (4) no integrity or availability impact. The score does not account for business-context factors such as regulatory exposure or reputational harm, which may elevate organizational risk above the base CVSS rating.

Frequently asked questions