CVE-2026-120513 · Package
NO FIX YET · SEE WHAT TO DO
The Everest Forms WordPress form builder plugin lets unauthenticated visitors delete files inside wp-content/uploads through insufficient file path validation in remove_csv_file_after_email_send. Deleting uploads/.htaccess on hardened Apache setups can re-enable PHP execution in the uploads folder.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Everest Forms plugin up to and including 3.6.2 with the Save-and-Continue addon active and 'Disable storing entry information' enabled on a form are exposed. Sites without that addon or setting are not described as exposed by the sources. The flaw is reachable without logging in.
Not affected if addon-inactive, storing-entries-enabled
Who cares everest-forms, self-hosted, wordpress
wp plugin get everest-forms --field=version or the Plugins screen in WordPress admin.wp-content/uploads/.htaccess still exists on the server.3.6.2 are affected; the sources do not name a fixed version.The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.