# CVE-2026-4888: WPEverest Everest Forms unauthorized email sending in send_test_email

Source: https://junglewise.ai/threats/cve-2026-4888-wpeverest-everest-forms-unauthorized-email-sending-in-send-test  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-4888 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Everest Forms, a popular WordPress plugin used for creating contact and payment forms, contains a security flaw that allows unauthorized users to send emails from the website's server. An attacker with basic login credentials, such as a subscriber, can exploit this to send test emails to any email address. While this does not directly expose sensitive data, it can be used to damage the organization's reputation or facilitate phishing campaigns by sending emails that appear to originate from a trusted corporate domain.

Technologies: [WPEverest Everest Forms](https://junglewise.ai/threats/technologies/everest-forms). Vendors: [WPEverest](https://junglewise.ai/threats/vendors/wpeverest).

## Quick answers

**Is CVE-2026-4888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4888 being exploited in the wild.

**How severe is CVE-2026-4888?** Medium severity, with a CVSS score of 4.3, published 28 May 2026.

**Which products and versions are affected?** WPEverest Everest Forms Up to and including 3.4.7.

**Is there a fix for CVE-2026-4888?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4888 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4888?** Check whether you run WPEverest Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the send_test_email() function located in the class-evf-ajax.php file. The plugin fails to perform a capability check to verify if the user has administrative privileges before executing the AJAX action. Consequently, any authenticated user with at least Subscriber-level permissions can trigger the function to send emails to arbitrary recipients from the server. This can lead to email spoofing or the use of the server as an open relay for spam. The issue is present in all versions up to and including 3.4.7.

## Affected products

- WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Up to and including 3.4.7

## Timeline

- 2026-05-27: disclosed: Initial disclosure by Wordfence
- 2026-05-28: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/class-evf-ajax.php](https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/class-evf-ajax.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/8bced7df-3e1a-4d7b-9ad0-64be5e18900f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/8bced7df-3e1a-4d7b-9ad0-64be5e18900f?source=cve)

## Related threats

- [WPEverest Everest Forms missing authorization in Site Assistant REST API](https://junglewise.ai/threats/cve-2026-12270-wpeverest-everest-forms-missing-authorization-in-site-assistant)
- [Everest Forms information disclosure via residual CSV artifacts](https://junglewise.ai/threats/cve-2026-11571-everest-forms-information-disclosure-via-residual-csv-artifacts)
- [WPEverest Everest Forms unauthenticated reflected XSS](https://junglewise.ai/threats/cve-2026-57312-wpeverest-everest-forms-unauthenticated-reflected-xss)
- [WPEverest Everest Forms PHP Object Injection in form entry metadata](https://junglewise.ai/threats/cve-2026-3296-wpeverest-everest-forms-php-object-injection-in-form-entry)