The Everest Forms plugin for WordPress contains a critical path traversal vulnerability that allows unauthenticated attackers to read sensitive configuration files or delete critical system files.

This vulnerability is a path traversal flaw (CWE-22) caused by the plugin failing to properly sanitize file paths provided in the old_files parameter during form processing. An unauthenticated attacker can exploit this to read sensitive files, such as wp-config.php, or trigger the deletion of arbitrary files on the server.

The ability for an unauthenticated attacker to read sensitive files like wp-config.php directly exposes database credentials and authentication salts, which can lead to full site takeover. Furthermore, the capacity to delete arbitrary files on the server can cause significant service disruption and data loss. With a CVSS score of 8.1, this represents a high-severity risk that demands immediate attention to maintain the integrity and availability of the web application.

Immediate Action: Update the Everest Forms plugin to the latest version, which contains the necessary security patches to prevent path traversal. If an update is not immediately possible, deactivate the plugin until a secure version can be deployed.

Proactive Monitoring: Review web server access logs for unusual POST requests targeting form submission endpoints that contain path traversal patterns, such as multiple dot-slash sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal characters (e.g., ../) in input parameters.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for complete site compromise and the ease with which this vulnerability can be triggered by unauthenticated actors, administrators must prioritize patching this plugin. Verify that all instances of Everest Forms are running the patched version and ensure that file upload forms are configured according to the latest vendor security best practices.