📄 Description (English)
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and including, 3.4.4. This is due to the plugin trusting attacker-controlled old_files data from public form submissions as legitimate server-side upload state, and converting attacker-supplied URLs into local filesystem paths using regex-based string replacement without canonicalization or directory boundary enforcement. This makes it possible for unauthenticated attackers to read arbitrary local files (e.g., wp-config.php) by injecting path-traversal payloads into the old_files upload field parameter, which are then attached to notification emails. The same path resolution is also used in the post-email cleanup routine, which calls unlink() on the resolved path, resulting in the targeted file being deleted after being attached. This can lead to full site compromise through disclosure of database credentials and authentication salts from wp-config.php, and denial of service through deletion of critical files. Prerequisite: The form must contain a file-upload or image-upload field, and disable storing entry information.
🤖 AI Executive Summary
The Everest Forms WordPress plugin (versions ≤3.4.4) contains a critical path traversal vulnerability allowing unauthenticated attackers to read and delete arbitrary files on affected servers. Attackers can exploit the old_files parameter in form submissions to access sensitive files like wp-config.php, potentially exposing database credentials and authentication salts. The vulnerability affects any WordPress site using this plugin with file-upload fields and disabled entry storage, posing immediate risk of full site compromise and data breach.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 26, 2026 00:54
🇸🇦 Saudi Arabia Impact Assessment
Saudi organizations using WordPress with Everest Forms plugin face critical risk, particularly: (1) Government agencies and NCA-regulated entities hosting public-facing forms for citizen services; (2) Banking and financial institutions using WordPress for customer portals or loan application forms; (3) Healthcare providers (MOH, private hospitals) collecting patient information via online forms; (4) E-commerce and retail sectors using forms for customer inquiries; (5) Telecommunications companies (STC, Mobily) with customer service forms. The vulnerability enables complete site compromise through credential theft and critical file deletion, directly impacting SAMA-regulated financial systems and NCA-supervised government infrastructure. High prevalence of WordPress in Saudi SMEs and government digital transformation initiatives amplifies exposure.
🏢 Affected Saudi Sectors
Government and Public Administration (NCA-regulated agencies, citizen service portals)
Banking and Financial Services (SAMA-regulated institutions, customer portals)
Healthcare (MOH facilities, private hospitals, patient data collection)
Telecommunications (STC, Mobily, customer service forms)
E-commerce and Retail (customer inquiry and order forms)
Education (universities, online application forms)
Energy and Utilities (ARAMCO contractors, service request forms)
Insurance (policy inquiry and claim forms)
Real Estate and Construction (property inquiry forms)
Small and Medium Enterprises (SMEs using WordPress for business operations)
🎯 MITRE ATT&CK Techniques
T1083 - File and Directory Discovery (enumerate files via path-traversal)
T1005 - Data from Local System (read wp-config.php and credentials)
T1040 - Network Sniffing (credentials exposed in email notifications)
T1485 - Data Destruction (delete critical files via unlink())
T1190 - Exploit Public-Facing Application (exploit WordPress plugin vulnerability)
T1566.002 - Phishing: Spearphishing Link (form submission as attack vector)
T1087 - Account Discovery (enumerate user accounts from wp-config.php)
T1110 - Brute Force (use stolen credentials for authentication)
T1021.001 - Remote Services: SSH (use stolen credentials for remote access)
T1047 - Windows Management Instrumentation (post-exploitation lateral movement)
⚖️ Saudi Risk Score (AI)
8.7
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Disable the Everest Forms plugin immediately via WordPress admin panel or command line (wp plugin deactivate everest-forms)
2. Audit server logs (access.log, error.log) for suspicious POST requests containing path-traversal patterns (../, ..\, encoded variants) in form submissions from the past 30 days
3. Check wp-config.php file integrity and verify database credentials have not been compromised; rotate database passwords immediately
4. Review file system for unexpected deletions in wp-content/uploads and root directories
PATCHING GUIDANCE:
1. No official patch currently available; monitor Everest Forms GitHub repository and official website for security updates
2. Contact plugin vendor (ThemeIsle) directly for patch timeline and interim security guidance
3. Do NOT re-enable plugin until patched version ≥3.4.5 is released and verified
COMPENSATING CONTROLS (if plugin must remain active):
1. Implement Web Application Firewall (WAF) rules to block requests containing path-traversal patterns in form POST data: block patterns like "../", "..%2f", "%2e%2e", "....//"
2. Restrict file upload directory permissions to 755 (read/execute only for web server)
3. Disable PHP execution in wp-content/uploads directory via .htaccess: <FilesMatch "\.php$"> Deny from all </FilesMatch>
4. Implement strict input validation at WAF level for old_files parameter
5. Enable WordPress security logging plugin to monitor file access attempts
DETECTION RULES:
1. Monitor for POST requests to /wp-admin/admin-ajax.php with action=everest_forms_* containing old_files parameter with path-traversal sequences
2. Alert on file access to wp-config.php from web server process outside normal WordPress initialization
3. Monitor for unlink() or file deletion operations on critical files (wp-config.php, .htaccess, wp-settings.php)
4. Log all form submissions and correlate with subsequent file modifications
5. SIEM rule: Detect multiple failed file read attempts followed by successful deletion attempts from same source IP
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. قم بتعطيل مكون Everest Forms فوراً عبر لوحة تحكم WordPress أو سطر الأوامر (wp plugin deactivate everest-forms)
2. قم بتدقيق سجلات الخادم (access.log, error.log) للبحث عن طلبات POST مريبة تحتوي على أنماط اجتياز المسار (../, ..\, متغيرات مشفرة) في إرسالات النماذج من آخر 30 يوماً
3. تحقق من سلامة ملف wp-config.php والتحقق من عدم اختراق بيانات اعتماد قاعدة البيانات؛ قم بتدوير كلمات مرور قاعدة البيانات فوراً
4. راجع نظام الملفات للتحقق من الحذف غير المتوقع في مجلدات wp-content/uploads والمجلدات الجذرية
إرشادات التصحيح:
1. لا يوجد تصحيح رسمي متاح حالياً؛ راقب مستودع Everest Forms على GitHub والموقع الرسمي للتحديثات الأمنية
2. اتصل بمورد المكون (ThemeIsle) مباشرة للحصول على جدول زمني للتصحيح والإرشادات الأمنية المؤقتة
3. لا تقم بإعادة تفعيل المكون حتى يتم إصدار وتحقق من الإصدار المصحح ≥3.4.5
الضوابط البديلة (إذا كان يجب أن يبقى المكون نشطاً):
1. قم بتنفيذ قواعد جدار حماية تطبيقات الويب (WAF) لحجب الطلبات التي تحتوي على أنماط اجتياز المسار في بيانات POST للنموذج: حجب الأنماط مثل "../", "..%2f", "%2e%2e", "....//"
2. قيد صلاحيات مجلد تحميل الملفات إلى 755 (قراءة/تنفيذ فقط لخادم الويب)
3. قم بتعطيل تنفيذ PHP في مجلد wp-content/uploads عبر .htaccess: <FilesMatch "\.php$"> Deny from all </FilesMatch>
4. قم بتنفيذ التحقق الصارم من المدخلات على مستوى WAF لمعامل old_files
5. قم بتفعيل مكون تسجيل أمان WordPress لمراقبة محاولات الوصول إلى الملفات
قواعد الكشف:
1. راقب طلبات POST إلى /wp-admin/admin-ajax.php مع action=everest_forms_* التي تحتوي على معامل old_files يحتوي على تسلسلات اجتياز المسار
2. تنبيه عند الوصول إلى الملف wp-config.php من عملية خادم الويب خارج تهيئة WordPress العادية
3. راقب عمليات unlink() أو حذف الملفات على الملفات الحرجة (wp-config.php, .htaccess, wp-settings.php)
4. قم بتسجيل جميع إرسالات النماذج والربط بين التعديلات اللاحقة على الملفات
5. قاعدة SIEM: كشف محاولات قراءة ملفات متعددة فاشلة متبوعة بمحاولات حذف ناجحة من نفس عنوان IP المصدر
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
ECC 2024 A.5.1.1 - Information Security Policies and Procedures (vulnerability management)
ECC 2024 A.5.2.1 - Access Control (unauthorized file access prevention)
ECC 2024 A.5.3.1 - Cryptography (protection of sensitive data like credentials)
ECC 2024 A.5.4.1 - Physical and Environmental Security (file integrity)
ECC 2024 A.5.5.1 - Operations Security (incident response and monitoring)
ECC 2024 A.5.6.1 - Communications Security (secure data transmission)
ECC 2024 A.5.7.1 - System Development and Maintenance (secure coding practices)
🔵 SAMA CSF
SAMA CSF Governance - Risk Management Framework (vulnerability assessment and remediation)
SAMA CSF Protect - Access Control (prevent unauthorized file access)
SAMA CSF Protect - Data Protection (safeguard wp-config.php and credentials)
SAMA CSF Detect - Monitoring and Logging (detect path-traversal attempts)
SAMA CSF Respond - Incident Response (breach notification and containment)
SAMA CSF Recover - Business Continuity (restore deleted critical files)
🟡 ISO 27001:2022
ISO 27001:2022 A.5.1 - Policies for information security (vulnerability management policy)
ISO 27001:2022 A.5.2 - Information security roles and responsibilities
ISO 27001:2022 A.5.3 - Segregation of duties (prevent unauthorized access)
ISO 27001:2022 A.5.15 - Access control (restrict file system access)
ISO 27001:2022 A.5.16 - Cryptography (protect sensitive credentials)
ISO 27001:2022 A.5.23 - Information security incident management
ISO 27001:2022 A.8.1 - Cryptographic controls (secure storage of wp-config.php)
ISO 27001:2022 A.8.2 - Technical vulnerability management
🟣 PCI DSS v4.0.1
PCI DSS 6.2 - Security patches and updates (apply patches promptly)
PCI DSS 6.5.1 - Injection flaws (path-traversal is injection vulnerability)
PCI DSS 10.2 - Logging and monitoring (detect unauthorized file access)
PCI DSS 10.3 - Log protection (protect audit trails from deletion)
PCI DSS 11.2 - Vulnerability scanning (identify Everest Forms vulnerability)
🔗 References & Sources 5
🔗
🔗
🔗
🔗
🔗
https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/...
security@wordfence.com
https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.4/includes/abstracts/...
security@wordfence.com
https://plugins.trac.wordpress.org/changeset/3507814/everest-forms
security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/8641eb53-6a9a-4549-b8ef-e37ac...
security@wordfence.com