EVEREST-FORMS · CVE-2026-115483 · Package
NO FIX YET · SEE WHAT TO DO
Everest Forms through 3.6.3 attaches any entry value under a signature_ meta key to notification emails after only a file_exists check, so an unauthenticated visitor can have files like wp-config.php emailed to an address they control. Wordfence lists it as unpatched; the Pro add-on and an Attach Files notification are required.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Everest Forms WordPress plugin at version 3.6.3 or earlier with the Everest Forms Pro add-on, where a form has email notifications with "Attach Files" enabled and a field matching the signature pattern. The sources say exploitation requires that combination, so sites without the Pro add-on or without such a form are less exposed. Sites on managed hosting that do not run this plugin can skip it.
Not affected if no-attach-files-setting, no-pro-addon, plugin-not-installed
Who cares everest-forms, php, plugin, pro-addon, wordpress
3.6.3 is affected) and that the Everest Forms Pro add-on is actives email notification for Attach Files' enabled plus a field whose meta key matches signature_3.6.3The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the “Attach Files” setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled “Signature”), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Attach FilesNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.