PHP EUVD-2026-23941

Vulnerable Everest Forms installation (≤3.4.4) with a public form containing a file-upload field or image-upload field AND the 'Disable storing entry information in database' option enabled in form settings (non-default configuration). This specific configuration requirement is the primary limiting factor-most WordPress forms retain entry data for record-keeping, making the vulnerable code path less commonly triggered. No authentication, user interaction, or special network access required beyond standard HTTP form submission capability. Exploitation is limited to sites where administrators have intentionally disabled entry storage for privacy, performance, or compliance reasons. Successful file deletion requires web server write permissions to target files, though read operations (file disclosure via email attachment) work regardless of deletion success.

Real-world risk is significant despite AC:H (high complexity) in the CVSS vector. The attack requires no authentication (PR:N) or user interaction (UI:N) and is remotely exploitable (AV:N), but complexity is elevated because the form must contain a file-upload field AND have entry storage disabled-a non-default configuration limiting the attack surface. The confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), reflecting complete site compromise potential through wp-config.php disclosure (database credentials, salts) and arbitrary file deletion. Wordfence-reported vulnerability with public source code references and changeset 3507814 confirming the fix increases exploitation likelihood. Without EPSS data or KEV status, we cannot confirm active exploitation, but the technical barrier is moderate-attackers must identify vulnerable forms with the specific configuration, then craft path-traversal payloads. The dual impact (read-then-delete) is particularly severe: exfiltrated credentials enable database access and privilege escalation, while deletion of wp-config.php or .htaccess files causes immediate denial of service. Priority is elevated for WordPress sites using Everest Forms with public-facing forms containing upload fields, especially if entry storage is disabled for privacy/performance reasons. The CVSS 8.1 accurately reflects severity, but real exploitation requires reconnaissance to identify vulnerable form configurations.

An unauthenticated attacker identifies a WordPress site running Everest Forms ≤3.4.4 with a publicly accessible contact form containing a file-upload field and entry storage disabled. The attacker submits a malicious form with a crafted old_files parameter containing '../../../../wp-config.php' using path traversal sequences. The plugin's flawed path resolution converts this to the local filesystem path of wp-config.php, attaches the file to the notification email sent to the site administrator, and subsequently deletes wp-config.php during the cleanup routine. The attacker either intercepts the email (if sent to a controlled address via other vulnerabilities) or exploits the deletion to cause site downtime, then uses error messages or backup exfiltration methods to obtain database credentials.