Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder With AI (<= 3.6.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/everest-forms--contact-form-payment-form-quiz-survey--custom-form-builder-with-ai--3.6.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 08:05:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEverest Forms: Unauthenticated file deletion (CVE-2026-120513)https://feed.craftedsignal.io/briefs/2026-11-everest-forms-file-deletion/Tue, 10 Nov 2026 08:05:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-everest-forms-file-deletion/The Everest Forms WordPress plugin is vulnerable to unauthenticated file deletion in the wp-content/uploads directory due to insufficient input validation in the remove_csv_file_after_email_send function.The Everest Forms plugin (up to version 3.6.2) for WordPress contains a file deletion vulnerability within the remove_csv_file_after_email_send function. An unauthenticated attacker can delete files in the wp-content/uploads directory when the Save-and-Continue addon is active and the "Disable storing entry information" setting is enabled on a specific form. If the deleted file is an .htaccess file, this may permit PHP execution in the uploads directory on affected Apache servers. In limited circumstances, the vulnerability may allow for file deletion outside of the uploads directory.

Impact

The vulnerability allows unauthorized deletion of files, potentially leading to data loss. Security configuration bypass may occur if an .htaccess file controlling security in the uploads directory is removed, enabling PHP execution of uploaded scripts.

Recommendation

  • Upgrade the Everest Forms plugin to a version later than 3.6.2 immediately.
  • Audit the WordPress uploads directory for unexpected deletion events or missing .htaccess files.
  • Disable the "Save-and-Continue" addon if it is not required until the plugin can be patched.
  • Verify that file system permissions prevent the web server user from deleting critical system files outside of the defined uploads directory.
]]>highadvisorywordpressvulnerabilitywebservercve-2026-120513