CVE-2025-1128 in the critical feed json
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
published 2025-02-25 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-5070
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 42.4%
- EPSS 42.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
Patch / fix
- wpeverest everest_forms 3.0.9.5
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
42.45% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
-
github.com
/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5
patch
-
github.com
/wpeverest/everest-forms/pull/1406/files
patch
-
plugins.trac.wordpress.org
/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0
patch
-
plugins.trac.wordpress.org
/changeset/3243663/everest-forms#file7
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cve
third-party-advisory
Sources
- CVE List CVE-2025-1128
- NVD CVE-2025-1128
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.