CVE-2026-12270 is a missing authorization vulnerability (CWE-862) in the Everest Forms WordPress plugin prior to version 3.5.0. The flaw exists because the capability check on several REST API endpoints for the onboarding assistant is conditional on a specific attacker-controllable request header value. Attackers can bypass this check by omitting or changing the header, enabling unauthenticated access to sensitive onboarding status information, modification of plugin options, and the ability to trigger emails to arbitrary addresses. The vulnerability affects version 3.4.2 as explicitly stated. No official patch or remediation level has been provided in the available data.

An unauthenticated attacker can bypass authorization controls on certain REST API endpoints, leading to information disclosure of onboarding status, unauthorized modification of plugin options, and the ability to send emails from the site to arbitrary addresses. This could facilitate further attacks such as phishing or social engineering but does not directly impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to the REST API endpoints via other means (e.g., web application firewall rules or IP restrictions) may reduce exposure.