Arbitrary File Read and Deletion Vulnerability in Everest Forms Plugin for WordPress

CVE-2026-5478

What is CVE-2026-5478?

The Everest Forms plugin for WordPress is susceptible to vulnerabilities that allow for arbitrary file reading and deletion. This occurs in versions up to and including 3.4.4, where the plugin improperly handles attacker-controlled data from public form submissions. Because it treats the supplied URLs as legitimate file paths without proper validation or canonicalization, attackers can manipulate the old_files upload parameter to execute path-traversal attacks. As a result, this could enable unauthorized access to sensitive local files, such as wp-config.php, and could lead to critical data exposure, including database credentials and authentication salts. Additionally, the vulnerability allows for deletion of the targeted files through routine cleanup processes, posing a significant risk to website integrity. This poses a severe risk if the form is equipped with a file-upload field and lacks entry information storage.

References