What is the CVSS score of CVE-2026-5478?

CVE-2026-5478 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-5478?

Everest Forms WordPress plugin versions 3.4.4 and earlier contain a critical path traversal vulnerability allowing unauthenticated attackers to read and delete arbitrary files, including…

How to fix or mitigate CVE-2026-5478?

Within 24 hours: Disable Everest Forms plugin immediately via WordPress admin dashboard or by renaming the plugin directory (/wp-content/plugins/everest-forms/); audit CloudTrail/server logs for suspicious form submissions with 'old_files' parameters. Within 7 days: Rotate all database credentials, authentication salts, and API keys previously stored in wp-config.php; scan wp-content/uploads/ and backups for exfiltrated files; review file deletion audit logs for unauthorized removals. Within 30 days: Identify and migrate to an alternative form builder plugin (Gravity Forms, WPForms, Forminator) or upgrade Everest Forms once vendor releases version >3.4.4 with patch; implement Web Application Firewall rules blocking requests containing 'old_files' parameter variations.

PHP CVE-2026-5478

EUVD-2026-23941 HIGH

Path Traversal (CWE-22)

2026-04-20 Wordfence

GHSA-xmpv-jqm7-jj2v

PHP Denial Of Service Path Traversal WordPress

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 20:33 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23941

Analysis Generated

Apr 20, 2026 - 20:00 vuln.today

CVE Published

Apr 20, 2026 - 19:27 nvd

HIGH 8.1

DescriptionCVE.org

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate server-side upload state, and converting attacker-supplied URLs into local filesystem paths using regex-based string replacement without canonicalization or directory boundary enforcement. This makes it possible for unauthenticated attackers to read arbitrary local files (e.g., wp-config.php) by injecting path-traversal payloads into the old_files upload field parameter, which are then attached to notification emails. The same path resolution is also used in the post-email cleanup routine, which calls unlink() on the resolved path, resulting in the targeted file being deleted after being attached. This can lead to full site compromise through disclosure of database credentials and authentication salts from wp-config.php, and denial of service through deletion of critical files. Prerequisite: The form must contain a file-upload or image-upload field, and disable storing entry information.

AnalysisAI

Path traversal in Everest Forms (WordPress plugin) allows unauthenticated attackers to read and delete arbitrary files on the server through malicious form submissions containing crafted old_files parameters. Vulnerable versions ≤3.4.4 use regex-based path resolution without canonicalization, enabling attackers to traverse directories, exfiltrate wp-config.php via email attachments (exposing database credentials and authentication salts), and trigger automatic deletion of targeted files post-email. CVSS 8.1 (AV:N/AC:H) reflects the remote vector with high attack complexity. EPSS and KEV status not provided; proof-of-concept details available in Wordfence advisory and plugin source code references.

Technical ContextAI

Everest Forms is a WordPress form builder plugin with file/image upload capabilities. The vulnerability resides in class-evf-form-fields-upload.php where the plugin processes old_files parameters from form submissions. The code performs regex-based string replacement to convert attacker-supplied URLs into filesystem paths without invoking realpath() canonicalization or validating directory boundaries. CWE-22 (Path Traversal) occurs when untrusted input directly influences file operations. In this case, the plugin treats client-controlled old_files data as legitimate server-side upload state, allowing payloads like '../../../../wp-config.php' to traverse out of intended upload directories. The resolved paths are used in two critical operations: (1) attachment to notification emails, causing file disclosure, and (2) unlink() calls in cleanup routines, causing file deletion. The affected CPE cpe:2.3:a:wpeverest:everest_forms_-_contact_form,_payment_form,_quiz,_survey_&_custom_form_builder identifies the exact product. The vulnerability chain combines information disclosure with destructive file operations, transforming a typical path traversal into a critical compromise vector.

RemediationAI

Upgrade Everest Forms to version 3.4.5 or later, which addresses the path traversal vulnerability per changeset 3507814 visible at https://plugins.trac.wordpress.org/changeset/3507814/everest-forms. The patch implements proper path canonicalization and directory boundary validation in the file upload handler. Until patching, implement these compensating controls with noted trade-offs: (1) Disable file-upload and image-upload fields in all public forms-this eliminates the attack vector but removes upload functionality; (2) Enable 'Store Entry Information' option in all forms with upload fields-this prevents triggering the vulnerable code path but increases database storage requirements and may conflict with privacy requirements (GDPR/data minimization); (3) Implement Web Application Firewall (WAF) rules to block form submissions containing '../' or encoded path traversal sequences in old_files parameters-this adds defense-in-depth but may cause false positives with legitimate filenames containing dots; (4) Restrict WordPress file permissions to read-only for the web server user where possible-this prevents file deletion but may break legitimate plugin update/upload functionality. Review server logs for suspicious form submissions containing path traversal patterns in POST data. After upgrade, verify wp-config.php and other critical files remain intact, and rotate database credentials and WordPress salts if compromise is suspected.