Insufficient File Path Validation in Everest Forms Plugin for WordPress

CVE-2026-120513

What is CVE-2026-120513?

The Everest Forms plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to delete files in the wp-content/uploads directory due to insufficient file path validation in the remove_csv_file_after_email_send function. This issue affects all versions up to 3.6.2 and is aggravated when the Save-and-Continue addon is active and the 'Disable storing entry information' setting is enabled. On servers with heightened security configurations, this could also lead to the deletion of critical files, potentially re-enabling PHP execution within the uploads directory. Under certain rare circumstances, attackers may even escalate this to delete files in the root directory of the site.

References