CVE-2025-1128 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, re…
Critical CVSS: 9.8

CVE-2025-1128

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
Vendor
Wpeverest
Product
Everest Forms
CWE
CWE-434
Yayın Tarihi
2025-02-25 07:15:18
Güncelleme
2025-02-28 15:59:40
Source Identifier
security@wordfence.com
KEV Date Added
-

Kategoriler

CWE-434 Everest Forms CRITICAL Wpeverest 2025

Referanslar

https://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5 https://github.com/wpeverest/everest-forms/pull/1406/files https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0 https://plugins.trac.wordpress.org/changeset/3243663/everest-forms#file7 https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cve