Everest Forms - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/everest-forms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 05:59:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEverest Forms: Arbitrary file read in Pro add-on (CVE-2026-115483)https://feed.craftedsignal.io/briefs/2026-11-everest-forms-file-read/Wed, 11 Nov 2026 05:59:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-everest-forms-file-read/The Everest Forms plugin for WordPress (Pro add-on) contains an arbitrary file read vulnerability that allows unauthenticated attackers to exfiltrate sensitive files by manipulating email notification attachments.Everest Forms plugin versions up to and including 3.6.3 contain an arbitrary file read vulnerability (CVE-2026-115483) within the attach_entry_files() function. The flaw occurs because the function performs a file_exists() check on entry fields with meta keys matching the pattern /signature_/ without validating or restricting the file path before attaching them to notification emails. Exploitation requires the use of the Everest Forms Pro add-on, which provides the necessary signature field and email attachment functionality.

Impact

An unauthenticated attacker can exfiltrate sensitive server-side files, such as wp-config.php, which may contain database credentials and other configuration secrets. The exfiltrated data is delivered directly to an attacker-controlled email address via the plugin notification system.

Recommendation

  • Update Everest Forms Pro to the latest available version containing the security fix for CVE-2026-115483.
  • Review form notification settings for any fields configured to use the "Signature" or similar fields that could be abused for file attachment.
  • Audit web server access logs for anomalous POST requests directed at form submission endpoints that result in repeated email notification triggers.
]]>highadvisory