Arbitrary File Deletion Vulnerability in Everest Forms Pro Plugin for WordPress

CVE-2025-5927

What is CVE-2025-5927?

The Everest Forms (Pro) plugin for WordPress contains a flaw in the delete_entry_files() function that allows for arbitrary file deletion due to inadequate file path validation. This vulnerability affects all versions up to and including 1.9.4. Although an attacker cannot directly exploit this vulnerability without administrative actions, they can leverage it by tricking an administrator into deleting a specific form entry. If sensitive files, such as wp-config.php, are deleted, it may lead to remote code execution, posing a severe risk to the server's integrity.

References