CVE-2026-12270: Everest Forms Auth Bypass Vulnerability

CVE-2026-12270 Overview

CVE-2026-12270 affects the Everest Forms WordPress plugin in versions before 3.5.0. The plugin fails to properly restrict access to several REST API endpoints belonging to its onboarding assistant. The capability check only runs when an attacker-controllable request header contains a specific value. Attackers can bypass authorization by omitting or altering that header.

Unauthenticated attackers can read onboarding status information, modify plugin options tied to the onboarding flow, and trigger emails from the site to arbitrary addresses. This creates opportunities for configuration tampering and abuse of the site as a mail relay for phishing.

Critical Impact
Unauthenticated attackers can modify plugin options and send emails from vulnerable sites to arbitrary recipients without any authentication.

Affected Products

Everest Forms WordPress plugin versions prior to 3.5.0

Discovery Timeline

2026-07-09 - CVE-2026-12270 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-12270

Vulnerability Analysis

The vulnerability is a broken access control flaw in the REST API surface of the Everest Forms onboarding assistant. Multiple endpoints register a permission callback that gates access on the value of an HTTP request header supplied by the client. Because the header is client-controlled, the check does not represent a trust boundary.

When the header is absent or set to a non-matching value, the plugin skips the capability check and treats the request as authorized. This inverts the intended logic, where the header was likely used to differentiate an onboarding context from other flows. Unauthenticated callers can therefore reach endpoints intended for administrators completing the setup wizard.

The impact spans three categories. Attackers can query onboarding status, exposing configuration state. They can write to plugin options associated with onboarding, altering site behavior. They can also invoke an endpoint that sends email from the site to an attacker-supplied address, enabling abuse of the site's mail infrastructure.

Root Cause

The permission callback conditions the capability check on the value of an attacker-controllable HTTP request header. The check runs only when the header matches an expected value, so removing or modifying the header bypasses authorization. The endpoints should have unconditionally enforced a current_user_can() check for an administrative capability.

Attack Vector

An unauthenticated remote attacker sends HTTP requests directly to the affected REST API routes registered by the onboarding assistant. By omitting the gating header, the attacker reaches handler code that reads onboarding status, updates plugin options, or triggers an outbound email to an address specified in the request body.

See the WPScan Vulnerability Report for technical details on the affected endpoints.

Detection Methods for CVE-2026-12270

Indicators of Compromise

Unauthenticated HTTP requests to REST API routes under the Everest Forms onboarding namespace, particularly from external IP addresses.
Unexpected changes to Everest Forms plugin options recorded in the WordPress wp_options table.
Outbound emails originating from the site to recipients unrelated to legitimate form submissions or administrator activity.
Requests to plugin REST endpoints that lack the gating header but still receive HTTP 200 responses.

Detection Strategies

Review web server access logs for POST and GET requests to /wp-json/ paths associated with the Everest Forms onboarding assistant from unauthenticated sources.
Correlate mail server logs with WordPress access logs to identify emails triggered by anonymous REST API calls.
Compare current Everest Forms option values against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Alert on REST API traffic to Everest Forms endpoints from IPs that have not authenticated to wp-login.php.
Track outbound SMTP volume from the WordPress host and alert on deviations from baseline.
Enable WordPress audit logging to capture option changes with the initiating user and request context.

How to Mitigate CVE-2026-12270

Immediate Actions Required

Upgrade the Everest Forms plugin to version 3.5.0 or later on all WordPress sites.
Audit the wp_options table for unauthorized modifications to Everest Forms configuration values.
Review mail transfer logs for suspicious outbound messages that may have been sent through the vulnerable endpoint.
Rotate credentials and tokens if configuration values that reference secrets appear to have been altered.

Patch Information

The vendor released a fix in Everest Forms version 3.5.0. The patched release enforces capability checks unconditionally on the affected REST API endpoints. Refer to the WPScan Vulnerability Report for the disclosure record.

Workarounds

If immediate patching is not possible, deactivate the Everest Forms plugin until the update can be applied.
Block external access to /wp-json/ paths belonging to the Everest Forms onboarding namespace using a web application firewall rule.
Restrict access to WordPress REST API endpoints to authenticated administrator sessions at the reverse proxy layer.

bash

# Example WAF rule to block unauthenticated access to the onboarding REST namespace
# Adjust the path to match the plugin's registered REST route
location ~ ^/wp-json/everest-forms/.*/onboard {
    deny all;
    return 403;
}