PULSE
LIVE24signals / 24h
ES
FEED
ransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Foundransomsafepay reclama a acsmallmaxwell.com.au · AU · Business Servicesransomsafepay reclama a mende-grundbesitz.de · DE · Business Servicesransomkairos reclama a College O'Sullivan de Québec · CA · Educationransomkairos reclama a Collge O'Sullivan de Québec · CA · Educationransomincransom reclama a Ali-Monde · US · Not Foundransomcoinbasecartel reclama a Caterpillar · US · Manufacturingransomanubis reclama a Bath Fitter · US · Consumer Servicesransomsafepay reclama a wdk.de · DE · Not Foundransomsafepay reclama a jaecklin-industrial.de · DE · Manufacturingransomsafepay reclama a lbb-treuhand.de · DE · Business Servicesransomsafepay reclama a timetex.de · DE · Business Servicesransomsafepay reclama a stroebel-gruppe.de · DE · Manufacturingransomsafepay reclama a industriesjaro.com · CA · Manufacturingransomsafepay reclama a cenesco.de · DE · Not Foundransomsafepay reclama a acsmallmaxwell.com.au · AU · Business Servicesransomsafepay reclama a mende-grundbesitz.de · DE · Business Servicesransomkairos reclama a College O'Sullivan de Québec · CA · Educationransomkairos reclama a Collge O'Sullivan de Québec · CA · Educationransomincransom reclama a Ali-Monde · US · Not Foundransomcoinbasecartel reclama a Caterpillar · US · Manufacturingransomanubis reclama a Bath Fitter · US · Consumer Services
← All CVEs
CVE WatchJul 9, 2026

CVE-2026-11571

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing

CVSS

7.5

High

EPSS

0.3%

p17

KEV

—

Exploit Today

5

0-100

Published: Jul 9, 2026 · Last modified: Jul 9, 2026

EPSS · 30d
0.1%EPSS · 30 days0.3%
2026-07-092026-07-20
Technical description

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

Official references
Related CVEs

No related CVEs by CWE or product.