CVE-2026-12270: WPEverest Everest Forms missing authorization in Site Assistant REST API

CVE-2026-12270 · Severity: info · CVSS 5.3 · Published 2026-07-09

Everest Forms, a popular WordPress plugin used for creating contact forms, contains a security flaw in its onboarding assistant. This vulnerability allows unauthorized individuals to bypass security checks by manipulating or omitting specific web request headers. As a result, an attacker could view internal setup status, change certain plugin settings, or use the website to send emails to arbitrary addresses, potentially damaging the site's reputation or disrupting its configuration.

Technologies: WPEverest Everest Forms. Vendors: WPEverest.

Quick answers

Is CVE-2026-12270 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12270 being exploited in the wild.
How severe is CVE-2026-12270?
Informational severity, with a CVSS score of 5.3, published 9 July 2026.
Which products and versions are affected?
WPEverest Everest Forms < 3.5.0.
Is there a fix for CVE-2026-12270?
A patch was published on 2026-07-09: Fixed in version 3.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12270 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12270?
Check whether you run WPEverest Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Everest Forms plugin before version 3.5.0 contains a missing authorization vulnerability within its Site Assistant REST API endpoints. The root cause is an improper capability check that is only triggered if a specific 'Referer' header is present in the request; by omitting or modifying this header, unauthenticated attackers can bypass the check entirely. Exploitation allows remote, unauthenticated attackers to read onboarding status, modify plugin options (such as skipping spam protection setup), and trigger the 'test-email' functionality to send emails from the host server to any arbitrary address. The issue is fixed in version 3.5.0.

Affected products

  • WPEverest Everest Forms < 3.5.0

Timeline

  • 2026-06-18: disclosed: Publicly published via WPScan
  • 2026-07-09: advisory: NVD publication date
  • 2026-07-09: patched: Fixed in version 3.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.