CVE-2025-1128

CVE-2025-1128 is a critical (CVSS 9.8) unauthenticated arbitrary file upload, read, and deletion flaw in the Everest Forms WordPress plugin (CWE-434), caused by missing file-type and path validation in the 'format' method of the EVF_Form_Fields_Upload class. An attacker with no account and no user interaction can send crafted requests to a site running an affected version to upload files of arbitrary type (potentially including executable PHP scripts), read arbitrary files on the server, or delete arbitrary files. Consequences can include remote code execution, disclosure of sensitive information such as configuration files, or deletion of critical files enabling complete site takeover. All Everest Forms versions up to and including 3.0.9.4 are affected, so any WordPress site running the plugin at one of those versions is in scope. No public proof-of-concept or CISA KEV listing is known at this time, but the 28.8% EPSS score (98th percentile) indicates a high probability of exploitation within the next 30 days.

What to do: Upgrade Everest Forms to version 3.0.9.5 or later (anything above 3.0.9.4) as soon as possible. If immediate patching is not possible, deactivate the plugin or remove file-upload fields from published forms, and consider a WAF rule blocking unauthenticated requests to the plugin's upload/AJAX endpoints. After patching, check upload directories (including wp-content/uploads/everest_forms) for unexpected or recently modified files, look for newly created rogue administrator accounts, and verify that core files such as wp-config.php have not been deleted or altered.