https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 11:27:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120513 <p>The Everest Forms – Contact Form, Payment Form, Quiz, Survey &amp; Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the &#39;Disable storing entry information&#39; setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.</p> <p>The Everest Forms – Contact Form, Payment Form, Quiz, Survey &amp; Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the &#39;Disable storing entry information&#39; setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120513 https://db.gcve.eu/vuln/ghsa-98gm-52cv-35p7 <p>The Everest Forms – Contact Form, Payment Form, Quiz, Survey &amp; Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the &#39;Disable storing entry information&#39; setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.</p> <p>The Everest Forms – Contact Form, Payment Form, Quiz, Survey &amp; Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the &#39;Disable storing entry information&#39; setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.</p> https://db.gcve.eu/vuln/ghsa-98gm-52cv-35p7