Threats tagged 'ghsa-98gm-52cv-35p7'

The Everest Forms WordPress plugin up to version 3.6.2 contains a file deletion vulnerability in the remove_csv_file_after_email_send function. This flaw allows unauthenticated attackers to delete files within the wp-content/uploads directory when the Save-and-Continue addon is active and a specific form setting is enabled. Under certain conditions, attackers may also delete critical files like uploads/.htaccess, potentially re-enabling PHP execution in the uploads directory. Rarely, deletion of files outside the uploads directory may be possible.