We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (CVE-2026-120513)

Nick Paliughi
On this page

Security Alert Summary

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress contains a file deletion vulnerability in the remove_csv_file_after_email_send function in versions up to and including 3.6.2. When the Save-and-Continue addon is active and the target form has the ‘Disable storing entry information’ setting enabled, unauthenticated attackers can delete files within the wp-content/uploads directory. This can result in loss of uploaded content and, on hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. Escaping the uploads directory and deleting files in the site root is reported as possible in rare circumstances.

CVE Details

  • CVE ID: CVE-2026-120513
  • Affected component: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (plugin)
  • Affected versions: All versions up to and including 3.6.2
  • Published: November 10, 2026 at 7:16:51 AM UTC
  • Last modified: November 10, 2026 at 7:16:52 AM UTC
  • CVSS v3.1: Base Score 8.2, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
  • Authentication / Privileges / User interaction: Authentication not required; Privileges required: None; User interaction: None (per CVSS data)
  • Primary impact: Integrity: High (file deletion); Availability: Low; Confidentiality: None
  • Weakness: CWE-22 (Path Traversal)

Technical Details

The vulnerability is caused by insufficient file path validation in the remove_csv_file_after_email_send function. Under the conditions described, the plugin does not adequately restrict which files can be removed, allowing unauthenticated requests to trigger deletion of files under wp-content/uploads. The issue is only exploitable when the Save-and-Continue addon is active (the constant EVF_SAVE_AND_CONTINUE_VERSION is defined) and the specific form has the ‘Disable storing entry information’ option enabled.

Impact is primarily the deletion of uploaded assets and CSV files saved by the plugin. On Apache configurations that rely on an uploads/.htaccess file to disable PHP execution, removal of that file can re-enable execution of PHP files placed in the uploads directory, increasing risk when combined with any ability to upload executable files. The description notes that escaping the uploads directory to delete files in the site root may be possible under rare circumstances.

How This Could Impact Your Website

In a realistic scenario, a site owner hosts forms that accept uploads and has staff and external contributors who submit or manage entries. If an attacker exploits this vulnerability, uploaded media or CSV exports used by internal staff could be deleted without authentication. That deletion may disrupt workflows, remove customer-submitted files, and require data restoration from backups. If uploads/.htaccess is removed on certain Apache setups, there is an increased risk that uploaded PHP files could be executed, which could further escalate risk when combined with other issues.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • If you cannot immediately update, review forms that use the Save-and-Continue addon and the ‘Disable storing entry information’ setting; disable or restrict those features where practical.
  • Review and reduce unnecessary user roles, especially contributor-level accounts that can upload files.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins and addons.
  • Monitor site activity and uploads for unusual deletions or file changes; ensure reliable backups are in place and test restores.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Cargo Shipping Location for WooCommerce Plugin Vulnerability (CVE-2026-106025)