The Everest Forms plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the 'format' method of the EVF_Form_Fields_Upload class. This flaw allows unauthenticated attackers to bypass file type and path validation controls, enabling arbitrary file upload, reading, and deletion on the server hosting the WordPress site. The vulnerability affects all versions up to and including 3.0.9.4. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation permits unauthenticated attackers to upload malicious files, read sensitive files, and delete files on the server. This can lead to remote code execution, disclosure of sensitive information, and potentially complete site takeover. The vulnerability severely compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's upload functionality if possible, and monitor for suspicious activity related to file uploads. Avoid using affected versions of the Everest Forms plugin in production environments. Follow vendor updates closely for an official patch or temporary mitigation.