CVE-2026-4888

Name of the Vulnerable Software and Affected Versions Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder versions prior to 3.4.8

Description The plugin is susceptible to unauthorized email sending because the send test email() function lacks a proper capability check. This allows authenticated users with Subscriber-level permissions or higher to send test emails to any arbitrary address from the server.

Recommendations Update to a version later than 3.4.7. As a temporary workaround, restrict access to the send test email() function to prevent unauthorized users from triggering email transmissions.