CVE-2025-5927

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-5927

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5927.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-5927

Published

2025-06-25T10:15:23.090Z

Modified

2026-04-10T05:31:55.564609Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteentryfiles() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.

References

Affected packages

Git / github.com/wpeverest/everest-forms

Affected ranges

Type

GIT

Repo

https://github.com/wpeverest/everest-forms

Events

Introduced

Fixed

7ed9f9513d7ec2d41994244fedae689b7ca5da57

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.5"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.0-rc.1

1.1.3

1.1.4

1.2.0

1.2.0-rc.1

1.3.0

1.3.2

1.3.4

1.4.0

1.4.0-beta

1.4.0-beta2

1.4.0-beta3

1.4.0-beta4

1.4.0-beta5

1.4.0-beta6

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.8

1.4.9

1.5.0

1.5.1

1.5.10

1.5.2

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.6.1

1.6.7

1.7.0

1.7.0.1

1.7.0.2

1.7.0.3

1.7.1

1.7.2

1.7.2.1

1.7.2.2

1.7.3

1.7.4

1.7.5

1.7.5.1

1.7.5.2

1.7.6

1.7.7

1.7.7.1

1.7.7.2

1.7.8

1.7.9

1.8.0

1.8.0.1

1.8.1

1.8.2

1.8.2.1

1.8.2.2

1.8.2.3

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0

1.9.0.1

1.9.1

1.9.2

1.9.3

1.9.4

1.9.4.1

v1.*

v1.4.0-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5927.json"