Threats Tagged 'cve-2026-5478'

CVE-2026-5478 is a path traversal vulnerability in the Everest Forms WordPress plugin up to version 3. 4. 4. It allows unauthenticated attackers to read and delete arbitrary local files by injecting path traversal payloads into the old_files upload field parameter in public form submissions. This vulnerability arises because the plugin trusts attacker-controlled data and performs insecure path resolution without enforcing directory boundaries. Exploitation can lead to disclosure of sensitive files like wp-config. php, resulting in potential full site compromise, and deletion of critical files causing denial of service. The vulnerability requires the form to have a file-upload or image-upload field and disabled entry information storage. No official patch or remediation guidance is currently available.