# CVE-2026-11571: Everest Forms information disclosure via residual CSV artifacts

Source: https://junglewise.ai/threats/cve-2026-11571-everest-forms-information-disclosure-via-residual-csv-artifacts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-11571 · Severity: info · CVSS 5.9 · Published 2026-07-09

Everest Forms is a popular WordPress plugin used to create contact and registration forms. A security flaw in versions prior to 3.5.0 fails to delete temporary files containing form submission data, leaving them publicly accessible on the web server. This allows unauthorized individuals to download and view sensitive information submitted by other users, such as names, email addresses, and private messages, by guessing simple file names.

Technologies: [WPEverest Everest Forms](https://junglewise.ai/threats/technologies/everest-forms). Vendors: [WPEverest](https://junglewise.ai/threats/vendors/wpeverest).

## Quick answers

**Is CVE-2026-11571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11571 being exploited in the wild.

**How severe is CVE-2026-11571?** Informational severity, with a CVSS score of 5.9, published 9 July 2026.

**Which products and versions are affected?** WPEverest Everest Forms < 3.5.0.

**Is there a fix for CVE-2026-11571?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11571 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11571?** Check whether you run WPEverest Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sensitive information disclosure vulnerability exists in Everest Forms (specifically when the Pro add-on is active) due to improper cleanup of temporary artifacts. When a form is configured with multiple email notifications and a CSV attachment is enabled on a notification that is not the last one processed, the plugin fails to delete the generated CSV file from the '/uploads/Everes-Froms-Entries-CSV-file/' directory. Because form entry IDs are sequential and disclosed in the submission response, unauthenticated attackers can enumerate and download these CSV files. The issue is fixed in version 3.5.0.

## Affected products

- WPEverest Everest Forms < 3.5.0

## Timeline

- 2026-06-18: disclosed: Publicly published by WPScan
- 2026-07-09: advisory: CVE published to NVD dataset

## References

- [https://wpscan.com/vulnerability/4bd381e9-2f4e-4e61-99af-88f50aed71f5/](https://wpscan.com/vulnerability/4bd381e9-2f4e-4e61-99af-88f50aed71f5/)

## Related threats

- [WPEverest Everest Forms missing authorization in Site Assistant REST API](https://junglewise.ai/threats/cve-2026-12270-wpeverest-everest-forms-missing-authorization-in-site-assistant)
- [WPEverest Everest Forms unauthenticated reflected XSS](https://junglewise.ai/threats/cve-2026-57312-wpeverest-everest-forms-unauthenticated-reflected-xss)
- [WPEverest Everest Forms unauthorized email sending in send_test_email](https://junglewise.ai/threats/cve-2026-4888-wpeverest-everest-forms-unauthorized-email-sending-in-send-test)
- [WPEverest Everest Forms PHP Object Injection in form entry metadata](https://junglewise.ai/threats/cve-2026-3296-wpeverest-everest-forms-php-object-injection-in-form-entry)