The Everest Forms WordPress plugin before version 3.5.0 does not reliably delete temporary CSV files created during email‑notification processing. These files remain in the public uploads directory and can be accessed by anyone who knows their predictable names, enabling the download of other users’ form submissions and resulting in a confidentiality breach. This issue results in a confidentiality breach by exposing sensitive data and allowing unauthorized access.

WordPress installations that have the Everest Forms plugin with a version older than 3.5.0 are impacted. All releases before 3.5.0 are vulnerable, as the software lacks the deletion mechanism in those builds.

With a CVSS score of 7.5 the risk is substantial. The EPSS score of less than 1 % indicates that exploitation attempts are uncommon, but the attack requires only knowledge of the filename pattern and no authentication. Since the vulnerability is not listed in the CISA KEV catalog, it has not yet been reported as a known exploit, but the simplicity of the attack means it could be leveraged by malicious actors in the future.