CVE-2026-12270: Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Everest Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12270?
The severity of CVE-2026-12270 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-12270?
To fix CVE-2026-12270, update the Everest Forms WordPress plugin to version 3.5.0 or later.
What impacts does CVE-2026-12270 have on my WordPress site?
CVE-2026-12270 allows unauthenticated users to access REST API endpoints, potentially leading to unauthorized actions.
Which versions of Everest Forms are affected by CVE-2026-12270?
CVE-2026-12270 affects all versions of Everest Forms prior to 3.5.0.
Is authentication required to exploit CVE-2026-12270?
No, CVE-2026-12270 can be exploited without authentication due to missing authorization checks.