CVE-2026-5478 - Vulnerability Analysis
HighCVSS: 8.1Last Updated: April 20, 2026
Everest Forms WordPress Plugin - Path Traversal
Overview
Everest Forms WordPress plugin <= 3.4.4 contains a path traversal vulnerability caused by unsafe handling of attacker-controlled old_files data in file upload processing, letting unauthenticated attackers read and delete arbitrary local files, exploit requires a form with file-upload or image-upload field and disabled entry storage.
Severity & Score
Impact
Unauthenticated attackers can read sensitive files and delete critical files, leading to full site compromise and denial of service.
Mitigation
Update to a version later than 3.4.4 or the latest available version.
References
- https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1665
- https://plugins.trac.wordpress.org/changeset/3507814/everest-forms
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8641eb53-6a9a-4549-b8ef-e37acbcc7f03?source=cve
- https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1306
- https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/class-evf-form-fields-upload.php#L1581
Social Media Activity(2 posts)
š CVE-2026-5478 - High (8.1) The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate ... š https://www.thehackerwire.com/vulnerability/CVE-2026-5478/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š CVE-2026-5478 - High (8.1) The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate ... š https://www.thehackerwire.com/vulnerability/CVE-2026-5478/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-5478
- Severity
- High
- CVSS Score
- 8.1
- Type
- path_traversal
- Status
- new
- EPSS
- 0.0%
- Social Posts
- 2
CWE
- CWE-22
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H