{"id":"CVE-2026-120513","kind":"vulnerability","aliases":["CVE-2026-120513"],"related":[],"title":"Everest Forms WordPress plugin: unauthenticated attackers can delete uploaded files","description":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.","summary":"The Everest Forms WordPress form builder plugin lets unauthenticated visitors delete files inside wp-content/uploads through insufficient file path validation in remove_csv_file_after_email_send. Deleting uploads/.htaccess on hardened Apache setups can re-enable PHP execution in the uploads folder.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["everest-forms","package","self-hosted","wordpress"],"not_affected_if":["addon-inactive","storing-entries-enabled"],"how_to_check":"- Check whether the plugin is installed and its version with `wp plugin get everest-forms --field=version` or the Plugins screen in WordPress admin.\n- Check whether the Save-and-Continue addon is active and whether 'Disable storing entry information' is enabled on any form.\n- Check that `wp-content/uploads/.htaccess` still exists on the server.","fix":"- Everest Forms (WordPress plugin): versions up to and including `3.6.2` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-10T07:16:51+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","triaged_at":"2026-11-10T07:21:01+00:00","updated_at":"2026-11-10T07:21:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T07:21:01Z","model":"claude-haiku-5-5","output":{"fix":"- Everest Forms (WordPress plugin): versions up to and including `3.6.2` are affected; the sources do not name a fixed version.","reach":"internet","title":"Everest Forms WordPress plugin: unauthenticated attackers can delete uploaded files","impact":"medium","summary":"The Everest Forms WordPress form builder plugin lets unauthenticated visitors delete files inside wp-content/uploads through insufficient file path validation in remove_csv_file_after_email_send. Deleting uploads/.htaccess on hardened Apache setups can re-enable PHP execution in the uploads folder.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","everest-forms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers delete uploaded files and can re-enable PHP execution","analyst_note":"Find the fixed version of Everest Forms after 3.6.2 at https://nvd.nist.gov/vuln/detail/CVE-2026-120513 or the plugin's changelog.","how_to_check":"- Check whether the plugin is installed and its version with `wp plugin get everest-forms --field=version` or the Plugins screen in WordPress admin.\n- Check whether the Save-and-Continue addon is active and whether 'Disable storing entry information' is enabled on any form.\n- Check that `wp-content/uploads/.htaccess` still exists on the server.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["addon-inactive","storing-entries-enabled"],"who_is_affected":"Sites running the Everest Forms plugin up to and including 3.6.2 with the Save-and-Continue addon active and 'Disable storing entry information' enabled on a form are exposed. Sites without that addon or setting are not described as exposed by the sources. The flaw is reachable without logging in.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000827,"input_tokens":4764,"output_tokens":701,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120513':13A,16A '-2026':12A,15A '/uploads':41B,130C '3.6.2':114C 'activ':173C 'addon':171C 'ai':83C 'apach':58B,145C 'attack':6A,121C,161C 'builder':30B,81C 'circumst':210C 'configur':146C 'contact':73C 'content':40B,129C,142C 'continu':170C,177C 'csv':49B,101C 'custom':79C 'cve':11A,14A 'defin':180C 'delet':8A,35B,54B,91C,123C,147C,199C 'directori':131C,159C,197C 'disabl':183C 'due':92C 'email':52B,104C 'enabl':63B,153C,189C 'entri':185C 'escap':194C 'everest':1A,18B,26B,71C 'everest-form':17B 'evf':174C 'execut':65B,155C 'file':10A,36B,44B,50B,90C,95C,102C,124C,200C 'folder':69B 'form':2A,19B,27B,29B,72C,74C,76C,80C,193C 'function':106C 'harden':57B,144C 'host':23B 'includ':113C 'inform':186C 'insid':37B,156C 'insuffici':43B,94C 'lead':137C 'let':32B 'loss':139C 'make':116C 'packag':20B 'path':45B,96C 'payment':75C 'php':64B,154C 'plugin':4A,31B,84C 'possibl':118C,164C,207C 'quiz':77C 'rare':209C 're':62B,152C 're-en':61B,151C 'remov':48B,100C 'root':204C 'save':168C,175C 'save-and-continu':167C 'self':22B 'self-host':21B 'send':53B,105C 'server':134C 'set':187C 'setup':59B 'site':203C 'store':184C 'survey':78C 'target':192C 'unauthent':5A,33B,120C 'upload':9A,68B,141C,158C,196C 'uploads/.htaccess':55B,149C 'valid':46B,97C 'version':109C,178C 'visitor':34B 'vulner':88C 'within':125C 'wordpress':3A,24B,28B,86C 'wp':39B,128C 'wp-content':38B,127C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Everest Forms plugin up to and including 3.6.2 with the Save-and-Continue addon active and 'Disable storing entry information' enabled on a form are exposed. Sites without that addon or setting are not described as exposed by the sources. The flaw is reachable without logging in.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["everestforms","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120513':13A,16A '-2026':12A,15A 'attack':6A 'cve':11A,14A 'delet':8A 'everest':1A 'file':10A 'form':2A 'plugin':4A 'unauthent':5A 'upload':9A 'wordpress':3A","search_b":"'/uploads':41B 'apach':58B 'builder':30B 'content':40B 'csv':49B 'delet':35B,54B 'email':52B 'enabl':63B 'everest':18B,26B 'everest-form':17B 'execut':65B 'file':36B,44B,50B 'folder':69B 'form':19B,27B,29B 'harden':57B 'host':23B 'insid':37B 'insuffici':43B 'let':32B 'packag':20B 'path':45B 'php':64B 'plugin':31B 're':62B 're-en':61B 'remov':48B 'self':22B 'self-host':21B 'send':53B 'setup':59B 'unauthent':33B 'upload':68B 'uploads/.htaccess':55B 'valid':46B 'visitor':34B 'wordpress':24B,28B 'wp':39B 'wp-content':38B","search_c":"'/uploads':130C '3.6.2':114C 'activ':173C 'addon':171C 'ai':83C 'apach':145C 'attack':121C,161C 'builder':81C 'circumst':210C 'configur':146C 'contact':73C 'content':129C,142C 'continu':170C,177C 'csv':101C 'custom':79C 'defin':180C 'delet':91C,123C,147C,199C 'directori':131C,159C,197C 'disabl':183C 'due':92C 'email':104C 'enabl':153C,189C 'entri':185C 'escap':194C 'everest':71C 'evf':174C 'execut':155C 'file':90C,95C,102C,124C,200C 'form':72C,74C,76C,80C,193C 'function':106C 'harden':144C 'includ':113C 'inform':186C 'insid':156C 'insuffici':94C 'lead':137C 'loss':139C 'make':116C 'path':96C 'payment':75C 'php':154C 'plugin':84C 'possibl':118C,164C,207C 'quiz':77C 'rare':209C 're':152C 're-en':151C 'remov':100C 'root':204C 'save':168C,175C 'save-and-continu':167C 'send':105C 'server':134C 'set':187C 'site':203C 'store':184C 'survey':78C 'target':192C 'unauthent':120C 'upload':141C,158C,196C 'uploads/.htaccess':149C 'valid':97C 'version':109C,178C 'vulner':88C 'within':125C 'wordpress':86C 'wp':128C 'wp-content':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T07:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120513","severity":null,"published_at":"2026-11-10T07:16:51+00:00","modified_at":"2026-11-10T07:16:52+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","fetched_at":"2026-11-10T07:20:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}