Everest Forms EUVD-2025-19094

The CVSS 7.5 score reflects High severity with critical real-world impact despite requiring admin interaction (UI:R). The CVSS vector breakdown shows Network accessibility (AV:N), High complexity requirement (AC:H), no privilege requirement (PR:N), and significant impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the AC:H and UI:R factors moderate the immediate exploitability—this is not a trivial attack requiring only network access. The vulnerability likely has moderate EPSS probability due to requiring admin interaction, making it a medium-priority issue from a pure automation perspective. Real-world risk is substantial for WordPress installations using this plugin, as the attack chain (social engineering admin to delete entries, attacker controls which files get deleted) is plausible. This represents a legitimate priority for organizations running Everest Forms, but automated exploitation is unlikely without compromising administrator accounts first.

An attacker identifies a target WordPress site running Everest Forms version 1.9.3 or earlier. The attacker crafts a specially formatted form entry deletion request containing a path traversal payload (e.g., file path parameter set to '../../../wp-config.php'). The attacker then contacts a site administrator through email or social engineering, requesting they delete a 'spam' or 'test' form entry while providing the malicious entry ID. When the administrator navigates to delete the entry through the WordPress admin panel, the backend delete_entry_files() function executes without validating the file path, deleting wp-config.php. The WordPress site becomes non-functional, and if the attacker can control file uploads afterward, they could recreate wp-config.php with modified database credentials or inject backdoors. Alternatively, an attacker with lower privileges (subscriber/contributor) could potentially craft entries designed to delete other plugin files or theme files during administrative cleanup operations. No public proof-of-concept is assumed unless explicitly disclosed post-advisory, but the straightforward nature of path traversal exploits makes rapid POC development likely after disclosure.