The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its send_test_email() function. This flaw allows any authenticated user with at least Subscriber privileges to send test emails to arbitrary addresses, bypassing intended capability checks. The issue affects all plugin versions up to and including 3.4.7. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, and limited impact on integrity only.

An attacker with Subscriber-level access or higher can exploit this vulnerability to send unauthorized test emails from the server. While this does not compromise data confidentiality or system availability, it can be abused for spam or phishing campaigns leveraging the legitimate server's email capabilities, potentially damaging reputation or causing indirect harm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unusual email activity related to the plugin. Avoid granting Subscriber-level users unnecessary access to the plugin's email functions.