Everest Forms < 3.5.0 – Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts | CVE 2026-11571

Description

The plugin does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

Exploitation requires the Everest Forms Pro add-on to be active (the CSV email-attachment option is provided by Pro) and a form with more than one email notification where the CSV attachment is enabled on a notification that is not processed last. Form entry identifiers are sequential and are returned to the submitter in the submission response, which makes the retained artifacts straightforward to enumerate.

Proof of Concept

Prerequisites: Everest Forms (free) and the Everest Forms Pro add-on both active. The "Send CSV attachment" email option is provided by the Pro add-on.

Environment preparation (admin, one-time, via the standard UI):
1. Create a form with fields Name, Email, Subject, and Message.
2. Open the form's Settings > Email and configure TWO notifications:
   - Notification A ("Admin Notification"): enable "Send CSV attachment".
   - Notification B ("User Notification"): leave "Send CSV attachment" disabled.
   Keep the order so that Notification B (CSV disabled) is processed after Notification A.
3. Publish the form on a public page.

Attack (unauthenticated):
1. Submit the form from the frontend as a normal visitor. The submission response discloses the entry id, e.g.:
   {"success":true,"data":{"form_id":4,"entry_id":1,"response":"success"}}
   (entry ids are sequential and can also simply be enumerated.)

2. The CSV that Notification A generated for that entry is NOT removed after processing. Retrieve it directly, with no authentication:
   GET /wp-content/uploads/Everes-Froms-Entries-CSV-file/Entry%20data-1.csv

   Response (HTTP 200, text/csv):
   ID,Name,Email,Subject,Message
   "1","Victim One","victim1@example.com","Confidential Subject One","Secret PII message ONE"

Existing entry ids return HTTP 200 and non-existing ids return HTTP 404, so retained artifacts can be distinguished and enumerated. For contrast, a form with a single notification that has the CSV attachment enabled correctly deletes the file after sending; the leak only occurs when a later-processed notification has the CSV attachment disabled.