---
id: "CVE-2026-120513"
page: "https://infrastack.ai/live/CVE-2026-120513"
kind: "vulnerability"
aliases: ["CVE-2026-120513"]
title: "Everest Forms WordPress plugin: unauthenticated attackers can delete uploaded files"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["everest-forms", "package", "self-hosted", "wordpress"]
not_affected_if: ["addon-inactive", "storing-entries-enabled"]
published_at: "2026-11-10T07:16:51+00:00"
first_seen_at: "2026-11-10T07:20:33+00:00"
updated_at: "2026-11-10T07:21:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120513", "first_seen_at": "2026-11-10T07:20:33+00:00"}]
exploit_sources: []
---

# Everest Forms WordPress plugin: unauthenticated attackers can delete uploaded files

Link for people: https://infrastack.ai/live/CVE-2026-120513 (this .md is for agents)

The Everest Forms WordPress form builder plugin lets unauthenticated visitors delete files inside wp-content/uploads through insufficient file path validation in remove_csv_file_after_email_send. Deleting uploads/.htaccess on hardened Apache setups can re-enable PHP execution in the uploads folder.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin is installed and its version with `wp plugin get everest-forms --field=version` or the Plugins screen in WordPress admin.
- Check whether the Save-and-Continue addon is active and whether 'Disable storing entry information' is enabled on any form.
- Check that `wp-content/uploads/.htaccess` still exists on the server.

## Fix

- Everest Forms (WordPress plugin): versions up to and including `3.6.2` are affected; the sources do not name a fixed version.

## Timeline

- 2026-11-10T07:20:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120513

## From the sources

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_