CVE-2026-4888: Everest Forms Auth Bypass Vulnerability

CVE-2026-4888 Overview

CVE-2026-4888 affects the Everest Forms WordPress plugin, which provides contact, payment, quiz, survey, and custom form builder functionality. The vulnerability stems from a missing capability check on the send_test_email() function in all versions up to and including 3.4.7. Authenticated users with Subscriber-level access or higher can invoke this function to send test emails to arbitrary recipients from the server. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact

Authenticated low-privilege users can abuse the WordPress site's mail infrastructure to send arbitrary test emails, enabling phishing relay, spam distribution, and potential damage to the domain's email reputation.

Affected Products

• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress
• All versions up to and including 3.4.7
• WordPress sites permitting Subscriber-level or higher account registration

Discovery Timeline

• 2026-05-28 - CVE-2026-4888 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-4888

Vulnerability Analysis

The Everest Forms plugin exposes an AJAX handler that triggers the send_test_email() function defined in includes/class-evf-ajax.php. The handler validates that the request originates from an authenticated session but fails to confirm the user holds an administrative capability such as manage_options. As a result, any logged-in user, including Subscribers, can submit the AJAX request and cause the WordPress installation to dispatch an email using attacker-controlled parameters.

The vulnerability impacts integrity by allowing unauthorized email transmission from the server, but it does not directly expose confidential data or affect availability. Attackers can leverage the issue to relay messages that appear to originate from the trusted WordPress domain, bypassing email authentication checks that rely on domain reputation.

Root Cause

The root cause is the absence of a current_user_can() capability check inside the send_test_email() AJAX handler. WordPress requires developers to gate privileged actions behind both nonce validation and capability checks. Everest Forms enforces neither sufficient capability validation nor restricted role access on this endpoint, leaving the function reachable by any authenticated session. See the WordPress Plugin Code Reference for the affected code path.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session at Subscriber level or above. On sites where open registration is enabled, an attacker can self-provision an account and immediately invoke the vulnerable AJAX action. The attacker submits a crafted POST request to admin-ajax.php referencing the test email action with arbitrary destination addresses. No user interaction from an administrator is required. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-4888

Indicators of Compromise

• Unexpected outbound email traffic from the WordPress host referencing Everest Forms test email templates
• Spikes in POST requests to /wp-admin/admin-ajax.php originating from Subscriber-level user sessions
• Bounce notifications or abuse complaints for messages sent to addresses unrelated to the site's normal mailing lists
• New Subscriber accounts created shortly before anomalous email send activity

Detection Strategies

• Review web server access logs for repeated admin-ajax.php calls invoking Everest Forms actions tied to test email functionality
• Correlate WordPress audit logs with the site's SMTP relay logs to identify low-privilege users triggering email dispatch
• Inspect installed Everest Forms versions across managed WordPress fleets and flag any instance at 3.4.7 or earlier

Monitoring Recommendations

• Enable WordPress activity logging plugins to capture AJAX actions and the user role that initiated them
• Configure outbound mail gateways to alert on volume thresholds and unusual destination domains from WordPress hosts
• Track creation of new Subscriber accounts on sites with open registration and review their post-registration AJAX activity

How to Mitigate CVE-2026-4888

Immediate Actions Required

• Update the Everest Forms plugin to a version newer than 3.4.7 once the vendor releases a patched build
• Disable open user registration on WordPress sites that do not require it by unchecking Settings → General → Membership
• Audit existing Subscriber accounts and remove any that were not provisioned by trusted administrators
• Rotate any shared SMTP relay credentials if abuse is suspected

Patch Information

A fixed release addressing the missing capability check is expected from the Everest Forms maintainers. Administrators should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Report for the patched version and apply it promptly. Until the patched version is installed, treat all sites running version 3.4.7 or earlier as vulnerable.

Workarounds

• Deactivate the Everest Forms plugin if test email functionality is not required
• Use a Web Application Firewall (WAF) rule to block unauthenticated and Subscriber-level requests to the send_test_email AJAX action
• Restrict access to /wp-admin/admin-ajax.php to specific roles using a capability-enforcement plugin
• Temporarily disable outbound email from the WordPress host at the SMTP layer if abuse is observed