Everest Forms: Arbitrary file read in Pro add-on (CVE-2026-115483)

Everest Forms plugin versions up to and including 3.6.3 contain an arbitrary file read vulnerability (CVE-2026-115483) within the attach_entry_files() function. The flaw occurs because the function performs a file_exists() check on entry fields with meta keys matching the pattern /signature_/ without validating or restricting the file path before attaching them to notification emails. Exploitation requires the use of the Everest Forms Pro add-on, which provides the necessary signature field and email attachment functionality.

Impact

An unauthenticated attacker can exfiltrate sensitive server-side files, such as wp-config.php, which may contain database credentials and other configuration secrets. The exfiltrated data is delivered directly to an attacker-controlled email address via the plugin notification system.

Recommendation

• Update Everest Forms Pro to the latest available version containing the security fix for CVE-2026-115483.
• Review form notification settings for any fields configured to use the "Signature" or similar fields that could be abused for file attachment.
• Audit web server access logs for anomalous POST requests directed at form submission endpoints that result in repeated email notification triggers.