CVE-2026-5478 Details

A vulnerability exists in the Everest Forms plugin for WordPress, affecting all versions through 3.4.4. The issue allows for arbitrary file reading and deletion. This vulnerability arises because the plugin improperly validates 'old_files' data from public form submissions, treating it as a legitimate server-side upload state. It uses regex-based string replacement to convert attacker-supplied URLs into local filesystem paths without proper canonicalization or directory boundary enforcement. As a result, unauthenticated attackers can inject path-traversal payloads into the 'old_files' upload field parameter to read arbitrary local files, such as 'wp-config.php'. The exploited payloads are attached to notification emails. Additionally, the same path resolution is applied in a post-email cleanup routine, which deletes the targeted files, potentially leading to a full site compromise by disclosing sensitive database credentials and authentication salts from 'wp-config.php', while also causing a denial-of-service by removing critical files.

Users are advised to update the Everest Forms plugin to version 3.4.5 or later, where this vulnerability has been patched.