PT-2025-26822 · WordPress · Everest Forms

Phat Rio · Published 2025-06-25 · Updated 2025-06-30 · CVE-2025-5927

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Everest Forms (Pro) plugin for WordPress versions up to, and including, 1.9.4

Description: The issue is related to insufficient file path validation in the delete entry files() function, allowing unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as wp-config.php, are deleted. The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.

Recommendations: For versions up to, and including, 1.9.4, update to a version that includes a fix for the insufficient file path validation in the delete entry files() function. As a temporary workaround, consider restricting access to the delete entry files() function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-5927

Affected Products

Everest Forms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-5927 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5927 · Vendor Advisory
• https://t.me/cvetracker/27008 · Telegram Post
• https://twitter.com/CVEnew/status/1937809338598302162 · Twitter Post
• https://t.me/cvenotify/126615 · Telegram Post
• https://everestforms.net/changelog · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9e3a118f-4321-4579-a986-05ce077dc6b9?source=cve · Note
• https://wordpress.org/plugins/everest-forms · Note
• https://twitter.com/cracbot/status/1939640107742679220 · Twitter Post