CVE Explorer
CVE-2026-5478
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate server-side upload state, and converting attacker-supplied URLs into local filesystem paths using regex-based string replacement without canonicalization or directory boundary enforcement. This makes it possible for unauthenticated attackers to read arb
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder","vendor":"wpeverest","versions":[{"lessThanOrEqual":"3.4.4","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1306"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1581"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1665"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/changeset/3507814/everest-forms"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/references/4
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8641eb53-6a9a-4549-b8ef-e37acbcc7f03?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:17383415e71985d3e2cc62f68351b2a1cef4e97030be5b0de9bcba540d1a91f5 · sha256:22e579bad172f128… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.