CVE-2026-12270: CWE-862 Missing Authorization in Everest Forms
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
AI Analysis
Technical Summary
CVE-2026-12270 describes a missing authorization vulnerability (CWE-862) in Everest Forms WordPress plugin version 3.4.2. The onboarding assistant REST API endpoints do not properly enforce capability checks unless a specific request header is present with a particular value. Attackers can bypass this check by omitting or modifying the header, leading to unauthorized access to onboarding status information, modification of plugin options, and the ability to send emails from the site to arbitrary recipients. No CVSS score or official patch information is currently available.
Potential Impact
Unauthenticated attackers can access sensitive onboarding status information, alter plugin configuration options, and cause the site to send emails to arbitrary addresses. This could lead to information disclosure, unauthorized configuration changes, and potential abuse of the site's email functionality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints through other means such as web application firewalls or disabling the onboarding assistant if possible.
CVE-2026-12270: CWE-862 Missing Authorization in Everest Forms
Description
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12270 describes a missing authorization vulnerability (CWE-862) in Everest Forms WordPress plugin version 3.4.2. The onboarding assistant REST API endpoints do not properly enforce capability checks unless a specific request header is present with a particular value. Attackers can bypass this check by omitting or modifying the header, leading to unauthorized access to onboarding status information, modification of plugin options, and the ability to send emails from the site to arbitrary recipients. No CVSS score or official patch information is currently available.
Potential Impact
Unauthenticated attackers can access sensitive onboarding status information, alter plugin configuration options, and cause the site to send emails to arbitrary addresses. This could lead to information disclosure, unauthorized configuration changes, and potential abuse of the site's email functionality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints through other means such as web application firewalls or disabling the onboarding assistant if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-15T11:00:01.358Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4f46b8c9d9e3dbe3ae73d8
Added to database: 07/09/2026, 06:59:04 UTC
Last enriched: 07/09/2026, 07:14:33 UTC
Last updated: 07/09/2026, 08:24:20 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.