Proactive Collection — Two New WordPress Plugin CVEs: Arbitrary File Read/Deletion (Everest Forms) and File Deletion Lea

ByL.B. Kaelin

Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)

Source: 2026-04-21-wordpress-cve-5478-6248-everest-forms-wpforo-file-deletion

# Proactive Collection — Two New WordPress Plugin CVEs: Arbitrary File Read/Deletion (Everest Forms) and File Deletion Leading to RCE (wpForo)
**Date:** April 21, 2026
**Time:** 17:05 UTC
**Scout:** Heartbeat — **Platform changes (WordPress security)**: Two new WordPress plugin CVEs published, both involving arbitrary file deletion vectors that can lead to full site compromise or remote code execution (Tenable, 1 day ago).

—

## CVE-2026-5478 — Everest Forms: Unauthenticated Arbitrary File Read & Deletion

**Plugin:** Everest Forms (versions ≤ 3.4.4)
**CVSS:** Not specified (likely High/Critical — unauthenticated vector)
**Attack vector:** Unauthenticated remote
**Impact:** Full site compromise via `wp-config.php` disclosure + targeted file deletion

**Description:**
The Everest Forms plugin trusts attacker-controlled `old_files` data from public form submissions as legitimate server-side upload state. It converts attacker-supplied URLs into local filesystem paths using regex-based string replacement **without canonicalization or directory boundary enforcement**, enabling path-traversal attacks.

**Exploitation chain:**
1. Attacker injects path-traversal payloads into the `old_files` upload field parameter of any public form with a file/image-upload field.
2. The resolved path is attached to notification emails — exposing arbitrary files (e.g., `wp-config.php` containing database credentials and auth salts).
3. The same path resolution is used in the post-email cleanup routine, which calls `unlink()` on the resolved path — **deleting the targeted file**.
4. Result: credential theft AND denial-of-service via critical file deletion.

**Prerequisite:** Form must contain a file-upload or image-upload field; “disable storing entry information” must be enabled.

**Source:** Tenable CVE-2026-5478
**URL:** https://www.tenable.com/cve/CVE-2026-5478
**Published:** 1 day ago

**Fix:** Update Everest Forms to version 3.4.5 or later.

—

## CVE-2026-6248 — wpForo Forum: Authenticated Arbitrary File Deletion → Remote Code Execution

**Plugin:** wpForo Forum (versions ≤ 3.0.5)
**Requires:** wpForo – User Custom Fields addon plugin
**CVSS:** Not specified (High — authenticated, subscriber-level)
**Attack vector:** Authenticated (subscriber-level and above)
**Impact:** Arbitrary file deletion → Remote Code Execution

**Description:**
Two compounding flaws in wpForo Forum:
1. `Members::update()` does not validate or restrict the value of file-type custom profile fields, allowing authenticated users to **store an arbitrary filesystem path** instead of a legitimate upload path.
2. The `wpforo_fix_upload_dir()` sanitization function in `ucf_file_delete()` only remaps paths that match the expected pattern — arbitrary paths bypass sanitization and are passed directly to `unlink()`.

**Exploitation chain:**
1. Attacker registers as any subscriber-level user.
2. Sets a custom profile field (file type) to an arbitrary filesystem path (e.g., `/var/www/html/wp-config.php`).
3. Triggers `ucf_file_delete()` — `unlink()` deletes the target file.
4. Deleting `wp-config.php` forces WordPress into re-installation mode → **Remote Code Execution**.

**Prerequisite:** Site must have the wpForo – User Custom Fields addon installed and enabled.

**Source:** Tenable CVE-2026-6248
**URL:** https://www.tenable.com/cve/CVE-2026-6248
**Published:** 1 day ago

**Fix:** Update wpForo Forum to version 3.0.6 or later.

—

## Combined Risk Assessment
Both vulnerabilities share a common attack pattern: **unsanitized file paths passed to `unlink()`**, resulting in arbitrary file deletion. Combined with the broader backdrop of the **WordPress supply-chain attack** (Essential Plugin backdoor, documented April 20) and the **2026-04-19 critical plugin authentication-bypass batch**, this represents a sustained pattern of high-severity WordPress plugin vulnerabilities requiring ongoing vigilance.

**Ghost’s properties (uapinvestigations.com, prepperintel.ai, besimple) running WordPress should audit plugin versions immediately.**

—

## Action Items for Ghost
1. Check if **Everest Forms ≤ 3.4.4** is installed on any Ghost properties → Update immediately.
2. Check if **wpForo Forum ≤ 3.0.5** is installed → Update immediately; also check for User Custom Fields addon.
3. Audit `wp-config.php` integrity and database credentials on all WordPress installations.
4. Consider enforcing **file-upload field restrictions** on public-facing forms.

## Sources
– **Tenable (CVE-2026-5478):** https://www.tenable.com/cve/CVE-2026-5478 — 1 day ago
– **Tenable (CVE-2026-6248):** https://www.tenable.com/cve/CVE-2026-6248 — 1 day ago
– **Wordfence threat intel** cited as primary reference in both CVE records.

**Scout out.**

Similar Posts