Everest Forms: Unauthenticated file deletion (CVE-2026-120513)

The Everest Forms plugin (up to version 3.6.2) for WordPress contains a file deletion vulnerability within the remove_csv_file_after_email_send function. An unauthenticated attacker can delete files in the wp-content/uploads directory when the Save-and-Continue addon is active and the "Disable storing entry information" setting is enabled on a specific form. If the deleted file is an .htaccess file, this may permit PHP execution in the uploads directory on affected Apache servers. In limited circumstances, the vulnerability may allow for file deletion outside of the uploads directory.

Impact

The vulnerability allows unauthorized deletion of files, potentially leading to data loss. Security configuration bypass may occur if an .htaccess file controlling security in the uploads directory is removed, enabling PHP execution of uploaded scripts.

Recommendation

• Upgrade the Everest Forms plugin to a version later than 3.6.2 immediately.
• Audit the WordPress uploads directory for unexpected deletion events or missing .htaccess files.
• Disable the "Save-and-Continue" addon if it is not required until the plugin can be patched.
• Verify that file system permissions prevent the web server user from deleting critical system files outside of the defined uploads directory.