CVE-2026-11571

Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

Affected

Everest Forms

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-07-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4bd381e9-2f4e-4e61-99af-88f50aed71f5/

References

• CVE Record
• NVD entry