Back to overview

CVE-2026-12270

MEDIUM Exploitation: PoC
6.5
CVSS 3.1
Description
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.

Metadata

CVE ID
CVE-2026-12270
State
PUBLISHED
Assigner
WPScan
Reserved
2026-06-15 11:00 UTC
Published
2026-07-09 06:00 UTC
Last updated
2026-07-09 14:45 UTC
Vendor / Product
Unknown / Everest Forms
Sources
cve.org  ·  NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Unknown Everest Forms — 3.4.2 < 3.5.0
Weakness (CWE)
CWESourceDescription
— cna CWE-862 Missing Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.5 MEDIUM 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References (1)
Back to overview