{"id":"CVE-2026-115483","kind":"vulnerability","aliases":["CVE-2026-115483"],"related":[],"title":"Everest Forms WordPress plugin: unauthenticated arbitrary file read via email attachments","description":"The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the “Attach Files” setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled “Signature”), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on.","summary":"Everest Forms through 3.6.3 attaches any entry value under a signature_ meta key to notification emails after only a file_exists check, so an unauthenticated visitor can have files like wp-config.php emailed to an address they control. Wordfence lists it as unpatched; the Pro add-on and an Attach Files notification are required.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"everest-forms","fixed":[],"affected":"<= 3.6.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["everest-forms","package","php","plugin","pro-addon","wordpress"],"not_affected_if":["no-attach-files-setting","no-pro-addon","plugin-not-installed"],"how_to_check":"Run wp plugin list and check everest-forms (<= 3.6.3 is affected) and that the Everest Forms Pro add-on is active. Then check each form's email notification for 'Attach Files' enabled plus a field whose meta key matches signature_.","fix":"No patched release listed by Wordfence as of 2026-11-10; check the wordpress.org changelog for a release above 3.6.3. Until then, turn off 'Attach Files' on form notifications that use a signature field, or deactivate the Pro add-on's file-email-attachments feature.","status":"open","published_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:50+00:00","updated_at":"2026-11-10T21:04:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:47:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Everest Forms WordPress plugin: unauthenticated arbitrary file read via email attachments","impact":"high","summary":"The Everest Forms plugin for WordPress, through version 3.6.3, attaches any form field whose key matches a signature pattern to notification emails without restricting the file path. An unauthenticated attacker can read arbitrary server files such as wp-config.php and have them emailed to an address they control.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","everest-forms","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Server secrets such as wp-config.php contents are readable by anyone.","analyst_note":"Fixed version not stated in the sources; check the WordPress.org plugin changelog or the Wordfence advisory for the patched release of Everest Forms.","how_to_check":"- Check the installed Everest Forms and Everest Forms Pro plugin versions in the WordPress admin plugins list or with `wp plugin list`\n- Confirm whether the Everest Forms Pro add-on is installed, since the sources say it is required for exploitation\n- Review form email notifications for the \"Attach Files\" setting enabled and a field matching a signature key","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-pro-addon","no-attach-files-setting"],"who_is_affected":"Sites running the Everest Forms WordPress plugin at version 3.6.3 or earlier with the Everest Forms Pro add-on, where a form has email notifications with \"Attach Files\" enabled and a field matching the signature pattern. The sources say exploitation requires that combination, so sites without the Pro add-on or without such a form are less exposed. Sites on managed hosting that do not run this plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00082,"input_tokens":4786,"output_tokens":682,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version not stated in the sources; check the WordPress.org plugin changelog or the Wordfence advisory for the patched release of Everest Forms.","search":"'-115483':14A,17A '-2026':13A,16A '/signature_':126C,192C '3.6.3':34B,104C 'add':76B,226C 'add-on':75B,225C 'addon':29B 'address':65B,210C 'arbitrari':6A,94C,155C 'attach':11A,35B,80B,107C,117C,178C,245C,250C 'attack':149C,207C,219C,253C 'attacker-suppli':206C 'check':52B,136C 'contain':165C,184C 'content':153C 'control':67B 'cve':12A,15A 'deliv':216C 'due':113C 'email':10A,46B,62B,130C,174C,209C,242C,249C 'enabl':181C 'entri':37B,108C,119C 'everest':1A,19A,22B,31B,86C,222C 'everest-form':21B 'everest-forms':18A 'exampl':194C 'exfiltr':213C 'exist':51B,135C 'exploit':169C,231C 'field':120C,186C,197C,239C 'file':7A,50B,59B,81B,95C,109C,134C,156C,179C,214C,244C,248C 'file-attach':243C 'file-email-attach':247C 'form':2A,23B,32B,87C,172C,223C 'forms':20A 'function':110C,116C,246C 'includ':103C 'inform':167C 'key':43B,124C,190C 'label':198C 'like':60B 'list':69B 'make':144C 'match':125C,191C 'meta':42B,123C,189C 'note':220C 'notif':45B,82B,129C,175C,202C 'packag':24B 'path':142C 'php':25B 'plugin':4A,26B,88C 'possibl':146C 'pro':28B,74B,224C 'pro-addon':27B 'provid':236C 'read':8A,96C,151C 'reli':254C 'requir':84B,170C,229C 'restrict':140C 'rout':203C 'sensit':166C 'server':159C 'set':180C 'signatur':41B,199C,238C 'success':168C 'suppli':208C 'text':196C 'unauthent':5A,55B,148C 'unpatch':72B 'valid':138C 'valu':38B,121C 'version':99C 'via':9A,105C 'visitor':56B 'vulner':92C,233C 'whose':122C,173C 'without':137C 'wordfenc':68B 'wordpress':3A,30B,90C 'wp-config.php':61B,162C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Everest Forms WordPress plugin at version 3.6.3 or earlier with the Everest Forms Pro add-on, where a form has email notifications with \"Attach Files\" enabled and a field matching the signature pattern. The sources say exploitation requires that combination, so sites without the Pro add-on or without such a form are less exposed. Sites on managed hosting that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["everestforms"],"ptokens":["everest","forms"],"labels":["everestforms","high","package","php","plugin","proaddon","wordpress"],"campaign_type":null,"search_a":"'-115483':14A,17A '-2026':13A,16A 'arbitrari':6A 'attach':11A 'cve':12A,15A 'email':10A 'everest':1A,19A 'everest-forms':18A 'file':7A 'form':2A 'forms':20A 'plugin':4A 'read':8A 'unauthent':5A 'via':9A 'wordpress':3A","search_b":"'3.6.3':34B 'add':76B 'add-on':75B 'addon':29B 'address':65B 'attach':35B,80B 'check':52B 'control':67B 'email':46B,62B 'entri':37B 'everest':22B,31B 'everest-form':21B 'exist':51B 'file':50B,59B,81B 'form':23B,32B 'key':43B 'like':60B 'list':69B 'meta':42B 'notif':45B,82B 'packag':24B 'php':25B 'plugin':26B 'pro':28B,74B 'pro-addon':27B 'requir':84B 'signatur':41B 'unauthent':55B 'unpatch':72B 'valu':38B 'visitor':56B 'wordfenc':68B 'wordpress':30B 'wp-config.php':61B","search_c":"'/signature_':126C,192C '3.6.3':104C 'add':226C 'add-on':225C 'address':210C 'arbitrari':94C,155C 'attach':107C,117C,178C,245C,250C 'attack':149C,207C,219C,253C 'attacker-suppli':206C 'check':136C 'contain':165C,184C 'content':153C 'deliv':216C 'due':113C 'email':130C,174C,209C,242C,249C 'enabl':181C 'entri':108C,119C 'everest':86C,222C 'exampl':194C 'exfiltr':213C 'exist':135C 'exploit':169C,231C 'field':120C,186C,197C,239C 'file':95C,109C,134C,156C,179C,214C,244C,248C 'file-attach':243C 'file-email-attach':247C 'form':87C,172C,223C 'function':110C,116C,246C 'includ':103C 'inform':167C 'key':124C,190C 'label':198C 'make':144C 'match':125C,191C 'meta':123C,189C 'note':220C 'notif':129C,175C,202C 'path':142C 'plugin':88C 'possibl':146C 'pro':224C 'provid':236C 'read':96C,151C 'reli':254C 'requir':170C,229C 'restrict':140C 'rout':203C 'sensit':166C 'server':159C 'set':180C 'signatur':199C,238C 'success':168C 'suppli':208C 'text':196C 'unauthent':148C 'valid':138C 'valu':121C 'version':99C 'via':105C 'vulner':92C,233C 'whose':122C,173C 'without':137C 'wordpress':90C 'wp-config.php':162C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115483","severity":null,"published_at":"2026-11-10T20:18:03+00:00","modified_at":"2026-11-10T20:18:03+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115483:2747","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/everest-forms-363-unauthenticated-arbitrary-file-read-via-signature-field-meta-key-branch-of-attach-entry-files","severity":null,"published_at":"2026-11-10T21:04:50+00:00","modified_at":"2026-11-10T21:04:50+00:00","first_seen_at":"2026-11-10T21:04:50+00:00","fetched_at":"2026-11-10T21:04:50+00:00","note":"Wordfence lists Everest Forms <=3.6.3 as Unpatched as of 2026-11-10; wordpress.org changelog not read for a fix. No exploitation or PoC seen. Not verified (third-party advisory).","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/everest-forms-363-unauthenticated-arbitrary-file-read-via-signature-field-meta-key-branch-of-attach-entry-files"]}],"documents":[{"id":118510,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/everest-forms-363-unauthenticated-arbitrary-file-read-via-signature-field-meta-key-branch-of-attach-entry-files","title":"Wordfence: Everest Forms <= 3.6.3 Unauthenticated Arbitrary File Read (Unpatched)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}