Everest Forms Plugin Vulnerability Allows Arbitrary File Read and Deletion

The National Vulnerability Database has detailed a critical flaw (CVE-2026-5478) in the Everest Forms WordPress plugin, affecting all versions up to 3.4.4. This vulnerability allows unauthenticated attackers to read sensitive files, such as wp-config.php, or delete critical files. The exploit leverages path traversal through the old_files parameter in form submissions, bypassing security controls by manipulating file paths. This can expose database credentials and authentication salts, or cause denial of service.

For a successful attack, the form must include a file-upload field, and the plugin must have entry information storage disabled. The National Vulnerability Database notes that the same path resolution logic is used in the post-email cleanup, enabling file deletion after the sensitive information is exfiltrated. Attackers can achieve full site compromise or disrupt operations.

Defenders must update the Everest Forms plugin immediately. Organizations should audit their WordPress installations for this vulnerable plugin and review logs for any signs of path traversal attempts or unauthorized file access. Given the potential for complete site compromise, prioritizing this update is essential.