The Everest Forms Pro plugin for WordPress contains an absolute path traversal vulnerability (CWE-36) in the delete_entry_files() function. This flaw allows unauthenticated attackers to specify arbitrary file paths for deletion on the server. However, the attack requires an admin user to perform the deletion action, as the attacker alone cannot trigger it. The vulnerability affects all versions up to and including 1.9.4. Deleting critical files such as wp-config.php can facilitate remote code execution. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and user interaction needed.

An attacker can cause arbitrary file deletion on the affected server by exploiting this vulnerability, potentially leading to remote code execution if key files are removed. The requirement for an administrator to trigger the deletion limits the attacker's ability to exploit the vulnerability independently but does not eliminate the risk if an admin is tricked or compromised. The impact includes full compromise of the WordPress installation and potentially the underlying server.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with user permissions and monitor for suspicious deletion activities involving form entries. Restricting admin access and validating plugin updates are recommended interim measures.