CVE-2026-11571: Everest Forms Information Disclosure Bug

CVE-2026-11571 Overview

CVE-2026-11571 affects the Everest Forms WordPress plugin in versions before 3.5.0. The plugin generates temporary CSV files during email-notification processing and fails to reliably delete them. These files remain publicly accessible inside the WordPress uploads directory. Because the filenames are predictable and enumerable, unauthenticated attackers can retrieve other users' form submission records directly over HTTP. The flaw is an information disclosure issue rooted in insecure file handling and missing access controls on generated artifacts.

Critical Impact
Unauthenticated remote attackers can enumerate and download CSV files containing form submission data, exposing personally identifiable information collected through Everest Forms.

Affected Products

Everest Forms WordPress plugin versions prior to 3.5.0
WordPress sites using Everest Forms email notifications with CSV export
Any site exposing the /wp-content/uploads/ directory to public access

Discovery Timeline

2026-07-09 - CVE-2026-11571 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-11571

Vulnerability Analysis

The Everest Forms plugin writes CSV attachments to the WordPress uploads directory when processing email notifications for form submissions. The plugin intends these files to be transient artifacts consumed by the mail subsystem. In versions before 3.5.0, the cleanup routine does not reliably remove the files after mail dispatch. The residual files remain in a web-accessible path and inherit standard uploads directory permissions.

The files include submission data such as names, email addresses, and any custom fields configured in the form. Because WordPress serves the uploads directory over HTTP by default, any file left behind is directly downloadable without authentication. This is classified as Sensitive Data Exposure combined with Broken Access Control on generated resources.

Root Cause

The root cause is twofold. First, the plugin does not guarantee deletion of temporary CSV files after the notification handler completes. Second, the plugin stores these files in a public path without adding an access control layer such as an .htaccess deny rule, a randomized non-guessable path, or storage outside the web root.

Attack Vector

An unauthenticated attacker enumerates candidate filenames in the uploads directory. Filenames follow a predictable pattern derived from form identifiers, timestamps, or sequential counters. The attacker issues HTTP GET requests against the guessed paths until valid CSV files are returned. Successful retrieval yields the full contents of prior form submissions. No credentials, user interaction, or elevated privileges are required.

Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-11571

Indicators of Compromise

Unauthenticated HTTP GET requests targeting .csv files under /wp-content/uploads/ paths associated with Everest Forms
High-volume enumeration patterns against uploads subdirectories from a single source IP or user agent
Access log entries returning HTTP 200 for CSV files with sequential or timestamp-based names
Residual CSV files present in uploads directories after form notification workflows complete

Detection Strategies

Review web server access logs for GET requests to CSV files under the uploads directory and correlate with form submission timestamps
Scan the WordPress uploads directory for orphaned CSV artifacts left by Everest Forms notification handlers
Monitor for directory enumeration behavior such as repeated 404 responses followed by 200 responses on the same path

Monitoring Recommendations

Alert on HTTP requests to /wp-content/uploads/**/*.csv from external IP addresses
Track outbound bytes served from uploads paths to detect bulk exfiltration of submission data
Audit the uploads directory on a scheduled basis for file types that should not persist there

How to Mitigate CVE-2026-11571

Immediate Actions Required

Upgrade Everest Forms to version 3.5.0 or later on all WordPress installations
Manually delete any leftover CSV files under /wp-content/uploads/ generated by the plugin
Review form submission data that may have been exposed and notify affected data subjects where required by regulation
Rotate any secrets or tokens that were submitted through affected forms

Patch Information

The vendor addressed the issue in Everest Forms 3.5.0. The patched release corrects the cleanup logic for CSV artifacts generated during email-notification processing. Site operators should apply the update through the WordPress plugin manager or via WP-CLI. See the WPScan Vulnerability Report for advisory references.

Workarounds

Deny direct HTTP access to CSV files within the uploads directory using web server rules until the patch is applied
Disable CSV attachments in Everest Forms email notifications if the feature is not required
Move the uploads directory storage for form artifacts outside the web-accessible root where feasible

bash

# Apache: block CSV access under wp-content/uploads
# Place in /wp-content/uploads/.htaccess
<FilesMatch "\.csv$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* ^/wp-content/uploads/.*\.csv$ {
    deny all;
    return 403;
}

# Update the plugin via WP-CLI
wp plugin update everest-forms --version=3.5.0