Everest Forms Plugin Leaves Temporary CSV Files Publicly Accessible

The Everest Forms WordPress plugin before version 3.5.0 fails to reliably delete temporary CSV files created during email notification processing, leaving sensitive form submission data exposed in the web-accessible uploads directory. These files use predictable, enumerable naming conventions that allow unauthenticated attackers to discover and retrieve other users' confidential information—including names, email addresses, phone numbers, and any custom form fields—without any authentication or authorization checks. This vulnerability affects WordPress sites using the Everest Forms plugin, particularly those collecting sensitive user data through forms, creating a direct path for data exfiltration affecting both site administrators and end users whose data is exposed.

While this CVE lacks explicit MITRE ATT&CK mapping, Casky's Claude AI reasoning engine would detect the attack patterns associated with Reconnaissance (T1592 - Gather Victim Identity Information, T1589 - Gather Victim Identity Information), Resource Development (T1583 - Acquire Infrastructure), and Exfiltration (T1041 - Exfiltration Over C2 Channel, T1020 - Automated Exfiltration) techniques. Practitioners using Casky would identify findings related to improper access control, insecure temporary file handling, and information disclosure risks. The platform's extended reasoning capabilities would flag the predictable filename enumeration pattern as a reconnaissance indicator and correlate it with unauthorized data access attempts in web server logs—revealing systematic scanning of the uploads directory and successful retrieval of CSV files containing PII, which represents active exploitation of this design flaw.