IT SBIT Services
Schneeberger
DEEN
CVE tracker

Everest Forms: Unauthenticated arbitrary file read via signature field

CVE-2026-115483High 7.5

← All vulnerabilities

Summary

The Everest Forms WordPress plugin, used with the Everest Forms Pro add-on, is affected in all versions up to and including 3.6.3. Because attach_entry_files() does not validate the file path, an unauthenticated attacker can read arbitrary files on the server, such as wp-config.php, which may contain database credentials. Exploitation requires a form with a signature-type field and an email notification that attaches files and is sent to an attacker-controlled address.

Affected

  • Everest Forms up to and including 3.6.3 (WordPress plugin)
  • Exploitation requires Everest Forms Pro

Fixed in

Unknown. No fixed version has been confirmed for this CVE.

Workaround

  • Disable the 'Attach Files' option in form email notifications (third-party guidance, not confirmed by the vendor)
  • Review and avoid signature fields in forms
  • If Pro is not needed, deactivate it until a fix is confirmed

Exploitation

  • Not known to be exploited in the wild (OffSeq listing)
  • No public proof of concept found
  • CISA KEV status not checked

Our recommendation

  • Inventory all WordPress sites with Everest Forms and Everest Forms Pro, and record the versions
  • For versions 3.6.3 or lower, update once the changelog confirms the fix; until then, disable 'Attach Files' and review signature fields
  • If a vulnerable configuration was exposed, review web server logs for unusual form submissions and rotate database credentials as a precaution
  • Watch the vendor channel and the CVE record for an official advisory

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:01.

Original description (NVD)

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to the notification email after only a file_exists() check, without validating or restricting the path. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, such as wp-config.php, which can contain sensitive information. Successful exploitation requires a form whose email notification has the “Attach Files” setting enabled and that contains a field with a meta key matching /signature_/ (for example, a text field labelled “Signature”), with the notification routed to an attacker-supplied email address so the exfiltrated file is delivered to the attacker. Note: The Everest Forms Pro add-on is required to exploit this vulnerability, as it provides the signature field and the email file-attachment functionality (file-email-attachments) that the attack relies on.

NVD references (15)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed