wpeverest Everest Forms Plugin up to 3.0.9.4 on WordPress Path Validation EVF_Form_Fields_Upload format unrestricted upload

Summaryinfo

A vulnerability, which was classified as critical, was found in wpeverest Everest Forms Plugin up to 3.0.9.4 on WordPress. The impacted element is the function format of the file EVF_Form_Fields_Upload of the component Path Validation Handler. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2025-1128. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in wpeverest Everest Forms Plugin up to 3.0.9.4 on WordPress. Affected by this issue is the function format of the file EVF_Form_Fields_Upload of the component Path Validation Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.

The weakness was disclosed by Arkadiusz Hydzik. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2025-1128 since 02/07/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

Upgrading to version 3.0.9.5 eliminates this vulnerability. Applying the patch 7d37858d2c614aa107b0f495fe50819a3867e7f5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wpeverest

Name

• Everest Forms Plugin

Version

• 3.0.9.0
• 3.0.9.1
• 3.0.9.2
• 3.0.9.3
• 3.0.9.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion