Unauthenticated REST API Access in Everest Forms WordPress Plugin

Executive Summary

CVE-2026-12270 is a vulnerability in the Everest Forms WordPress plugin versions before 3.5.0. It occurs because the plugin does not properly restrict access to several REST API endpoints related to its onboarding assistant.

The plugin applies a capability check only when a specific request header has a certain value. However, this check can be bypassed by omitting or changing that header, allowing unauthenticated attackers to access these endpoints.

As a result, attackers can read onboarding status information, modify plugin options, and trigger emails from the site to arbitrary email addresses without needing to authenticate.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts on a site using the affected Everest Forms plugin versions:

• Unauthenticated attackers can read sensitive onboarding status information.
• Attackers can modify plugin options, potentially changing site behavior or configurations.
• Attackers can trigger emails from the site to arbitrary email addresses, which could be used for spam or phishing.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the Everest Forms plugin's onboarding assistant REST API endpoints without authentication and by omitting or altering the specific request header that is supposed to restrict access.

A practical approach is to send HTTP requests to the plugin's REST endpoints related to the onboarding assistant and observe if you can read onboarding status information or trigger actions such as sending emails without proper authentication.

• Use curl or similar tools to send requests without the specific header or with altered header values to endpoints like /wp-json/everest-forms/v1/onboarding or similar paths.
• Example curl command to test unauthorized access: curl -X GET https://yourwordpresssite.com/wp-json/everest-forms/v1/onboarding
• Example curl command to test modifying options or triggering emails: curl -X POST https://yourwordpresssite.com/wp-json/everest-forms/v1/onboarding -d '{"action":"send_test_email","email":"[email protected]"}' -H "Content-Type: application/json"

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation step is to update the Everest Forms WordPress plugin to version 3.5.0 or later, where this vulnerability has been fixed.

Until the update can be applied, restrict access to the REST API endpoints related to the Everest Forms onboarding assistant by implementing additional access controls at the web server or application firewall level.

• Apply IP whitelisting or authentication requirements to the REST API endpoints used by Everest Forms.
• Monitor logs for suspicious requests to the Everest Forms REST API endpoints that omit or alter the specific header.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to access and modify sensitive plugin options and trigger emails to arbitrary addresses by bypassing access controls. This unauthorized access and potential data manipulation could lead to violations of data protection principles required by standards such as GDPR and HIPAA, which mandate strict access controls and protection of personal data.

Specifically, the ability to read onboarding status information and send emails without authentication may expose personal or sensitive information, increasing the risk of data breaches and non-compliance with regulations that require safeguarding user data and ensuring only authorized access.

Useful 0 Not Useful 0