PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4888 wpeverest CVE debrief

The Everest Forms WordPress plugin is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function. This allows authenticated attackers with Subscriber-level access and above to send test emails to arbitrary addresses from the server. The vulnerability affects all versions up to and including 3.4.7. The issue was disclosed on 2026-05-28 and has a CVSS 3.1 score of 4.3 (Medium severity). The root cause is classified as CWE-862 (Missing Authorization).

Vendor
wpeverest
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

WordPress site administrators using Everest Forms plugin; security teams monitoring for unauthorized email abuse; hosting providers detecting outbound spam from compromised sites

Technical summary

The send_test_email() function in class-evf-ajax.php lacks a capability check, permitting any authenticated user (Subscriber+) to invoke the function and send emails to arbitrary addresses. The vulnerability is exploitable via AJAX requests to the plugin's admin-ajax.php endpoint. No special permissions beyond valid WordPress authentication are required.

Defensive priority

medium

Recommended defensive actions

  • Update Everest Forms plugin to version 3.4.8 or later
  • Review WordPress user accounts for unauthorized Subscriber registrations
  • Monitor server mail logs for suspicious test email activity
  • Implement principle of least privilege for WordPress user roles
  • Consider Web Application Firewall rules to restrict access to AJAX endpoints

Evidence notes

The vulnerability exists in the send_test_email() function within the plugin's AJAX handler. The Wordfence advisory confirms the missing capability check allows low-privileged authenticated users to trigger email sending functionality intended for administrative use.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4888 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4888

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4888 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4888

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.