CVE-2026-12270: Everest Forms Authentication Bypass in REST API Endpoints

Technical summary

CVE-2026-12270 is an authentication bypass vulnerability in Everest Forms before version 3.5.0. The plugin's REST API endpoints for the onboarding assistant lack proper capability enforcement: the permission check is conditional on the presence of a specific attacker-controllable request header. When this header is absent or modified, the endpoints return sensitive data and accept state-modifying requests without authentication. The vulnerability is rooted in inadequate access control design, allowing unauthenticated actors to enumerate and manipulate plugin configuration through the REST interface.

Business impact

Organizations running Everest Forms on customer-facing or internal WordPress installations face several concrete risks. An attacker could discover setup state information (potentially leaking configuration details), modify form settings or plugin options without authorization, and exploit the arbitrary email functionality to send fraudulent communications appearing to originate from the affected site. For customer-facing implementations, this could lead to phishing campaigns, loss of customer trust, and potential regulatory exposure if user data is exposed during reconnaissance. For internal tools, unauthorized configuration changes could disrupt business workflows.

Affected systems

Everest Forms WordPress plugin versions prior to 3.5.0 are affected. The vulnerability applies to any WordPress installation where Everest Forms is active and REST API access is enabled (the default configuration). Sites running version 3.5.0 or later are not affected. The severity of exposure depends on the site's role: public forms and unauthenticated REST endpoints create higher risk than internal or private deployments.

Exploitability

The vulnerability is straightforward to exploit. An attacker requires only network access to the WordPress site's REST API—no authentication, user interaction, or special conditions are needed. The attack vector is network-based and the attack complexity is low: a simple HTTP request with a modified or absent header bypasses the security check. No current evidence indicates this vulnerability is actively exploited in the wild (it is not on the CISA KEV list), but the simplicity of exploitation means it could be weaponized quickly if discovered by threat actors.

Remediation

Update Everest Forms to version 3.5.0 or later immediately. This version corrects the capability check to enforce authentication regardless of HTTP headers. Organizations should verify the update is deployed across all WordPress instances running the plugin. In environments where immediate patching is not feasible, consider disabling the plugin temporarily or restricting REST API access via firewall rules or WordPress security plugins (though these are temporary measures only).

Patch guidance

WordPress administrators should navigate to the Plugins section of their dashboard, locate Everest Forms, and verify the installed version. If running a version prior to 3.5.0, click 'Update' to deploy version 3.5.0 or later. For organizations managing multiple WordPress instances, use a plugin management tool or update framework to deploy patches consistently. After patching, test form submission workflows to ensure functionality is not affected by the security update. Verify against the official Everest Forms plugin page and vendor advisory for version confirmation.

Detection guidance

Monitor WordPress REST API logs for requests to endpoints matching /wp-json/everest-forms/* or similar onboarding paths, especially those originating from unauthenticated sessions. Look for requests that lack expected authorization headers or contain modified header values. Intrusion detection systems should flag attempts to access REST API endpoints without proper authentication context. If you have access to WordPress logs, search for REST API calls to Everest Forms endpoints combined with lack of user authentication. Consider deploying WordPress security plugins that monitor and alert on unauthorized API access patterns.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.5), this vulnerability warrants high priority due to its low complexity of exploitation, network accessibility, and the confidentiality and integrity impact it enables. The combination of information disclosure and state modification (through email injection and option changes) makes it more dangerous than the CVSS score alone suggests. Organizations with public-facing forms should patch immediately; internal deployments should follow within standard patching windows. The absence from the CISA KEV list does not diminish urgency, as active exploitation could begin at any time given the ease of attack.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects the vulnerability as MEDIUM severity based on: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege required (PR:N), no user interaction needed (UI:N), unchanged scope (S:U), and impacts to confidentiality (C:L) and integrity (I:L) with no availability impact (A:N). While this places it in the middle range of severity, the practical impact is substantial because exploitation requires zero barriers to entry and can affect form submission integrity and site reputation through email abuse.

Frequently asked questions