The Everest Forms plugin for WordPress improperly limits pathname access, leading to a path traversal vulnerability (CWE-22). The plugin trusts attacker-controlled old_files data from public form submissions and converts attacker-supplied URLs into local filesystem paths using regex-based replacement without canonicalization or directory boundary enforcement. This flaw enables unauthenticated attackers to read arbitrary local files by injecting path traversal payloads into the old_files parameter, which are then included in notification emails. Additionally, the same path resolution is used in a cleanup routine that deletes the resolved file, allowing attackers to delete arbitrary files on the server. This can expose sensitive configuration files such as wp-config.php, leading to potential full site compromise and denial of service.

Successful exploitation can disclose sensitive local files including wp-config.php, exposing database credentials and authentication salts, which may lead to full site compromise. It also allows deletion of arbitrary files, causing denial of service by removing critical files. The vulnerability requires no authentication but depends on specific form configurations (file-upload/image-upload fields and disabled entry storage).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and disable vulnerable form features if possible. Monitor vendor channels for updates and apply patches promptly once released.