EUVD-2025-19094CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.
AnalysisAI
The Everest Forms (Pro) WordPress plugin versions up to 1.9.4 contain an arbitrary file deletion vulnerability in the delete_entry_files() function due to insufficient path validation (CWE-36). Unauthenticated attackers can delete arbitrary files on the server by tricking an administrator into deleting a form entry, potentially leading to remote code execution through deletion of critical files like wp-config.php. This is a high-severity vulnerability (CVSS 7.5) that requires social engineering or admin interaction but can completely compromise WordPress installations.
Technical ContextAI
The vulnerability exists in the Everest Forms plugin for WordPress, affecting the form entry deletion functionality. The root cause is CWE-36 (Absolute Path Traversal), which allows attackers to manipulate file paths without proper validation. The delete_entry_files() function fails to sanitize or validate file paths before deletion, enabling path traversal attacks. This is a classic file operation security flaw common in web applications that handle file management without strict input validation. The WordPress plugin architecture makes this particularly dangerous as plugins operate with WordPress core privileges, and deletion of wp-config.php would immediately disable the entire WordPress installation.
RemediationAI
Users should immediately update Everest Forms to a version greater than 1.9.4 once available from the plugin vendor (WP Everest). The patch should include proper file path validation and sanitization in the delete_entry_files() function. Interim workarounds prior to patch availability include: (1) Restrict file deletion permissions by disabling entry deletion features if not critical to operations, (2) Implement WordPress user role restrictions to limit which administrators can delete form entries, (3) Apply Web Application Firewall (WAF) rules to detect path traversal patterns in form entry deletion requests, (4) Monitor file system access logs for unexpected deletions of critical files. Recommendation: Update to patched version 1.9.5 or later as soon as released; verify patch availability on the official Everest Forms repository or vendor advisory page.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Remote code execution in the WPCode WordPress plugin (versions through 2.3.5) lets authenticated author-level users run
Share
External POC / Exploit Code
Leaving vuln.today