CVE-2025-5927: Everest Forms WordPress Plugin RCE Flaw

CVE-2025-5927 Overview

The Everest Forms Pro plugin for WordPress contains an arbitrary file deletion vulnerability in the delete_entry_files() function due to insufficient file path validation. This security flaw affects all versions up to and including 1.9.4, allowing unauthenticated attackers to delete arbitrary files on the server when an administrator triggers deletion of a form entry. Successful exploitation can lead to remote code execution when critical files such as wp-config.php are deleted.

Critical Impact

Unauthenticated attackers can achieve remote code execution by tricking an administrator into deleting a form entry, which deletes critical WordPress configuration files and forces the site into a vulnerable reinstallation state.

Affected Products

• Everest Forms Pro plugin for WordPress versions up to and including 1.9.4
• wpeverest everest_forms

Discovery Timeline

• 2025-06-25 - CVE-2025-5927 published to NVD
• 2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-5927

Vulnerability Analysis

This vulnerability is classified under CWE-36 (Absolute Path Traversal), which occurs when user-controlled input is used to construct file paths without proper validation. The delete_entry_files() function in the Everest Forms Pro plugin fails to adequately sanitize file path parameters before performing file deletion operations. While the vulnerability requires a social engineering component where an administrator must trigger the deletion of a form entry, the attacker can craft malicious form submissions containing path traversal sequences that target critical system files.

The attack chain involves an unauthenticated attacker submitting a specially crafted form entry containing malicious file path references. When an administrator later deletes this entry through the WordPress admin interface, the plugin processes the deletion request and removes the attacker-specified files without validating that the paths are confined to the expected upload directories.

Root Cause

The root cause of CVE-2025-5927 lies in insufficient file path validation within the delete_entry_files() function. The function processes user-supplied file path data without implementing proper input sanitization or path canonicalization. This allows attackers to inject path traversal sequences (such as ../) that escape the intended directory structure and target arbitrary files on the filesystem. The absence of a whitelist-based approach to validate that target files reside within expected directories enables this exploitation scenario.

Attack Vector

The attack is network-based and requires user interaction from an administrator. The exploitation flow follows these steps:

1. An unauthenticated attacker submits a form entry through the public-facing Everest Forms interface
2. The attacker crafts the submission to include malicious file path references containing path traversal sequences
3. These references target critical WordPress files such as wp-config.php
4. When a WordPress administrator reviews and deletes the malicious form entry, the delete_entry_files() function processes the deletion
5. Due to insufficient path validation, the function deletes the attacker-specified files
6. Deleting wp-config.php forces WordPress into a reinstallation state, potentially allowing the attacker to take over the site

The vulnerability exploits the trust relationship between form entry data and administrative deletion operations. The complexity of the attack is considered high because it requires administrator interaction, but the potential impact is severe as successful exploitation can lead to complete site compromise.

Detection Methods for CVE-2025-5927

Indicators of Compromise

• Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or index.php
• Form entries containing suspicious path traversal patterns like ../ or encoded variants
• WordPress site suddenly displaying installation wizard when previously configured
• Unusual file system activity in web server error logs related to the Everest Forms plugin

Detection Strategies

• Monitor web application logs for form submissions containing path traversal sequences such as ../, ..%2f, or ..%5c
• Implement file integrity monitoring on critical WordPress files including wp-config.php and core system files
• Review form entry data for suspicious patterns before administrative actions
• Deploy web application firewall rules to detect and block path traversal attempts in POST requests to Everest Forms endpoints

Monitoring Recommendations

• Enable audit logging for all administrative actions within the WordPress dashboard, particularly form entry deletions
• Configure alerts for unexpected changes to file system permissions or ownership on WordPress directories
• Monitor for sudden increases in form submissions from single IP addresses or containing unusual data patterns
• Implement real-time monitoring of the wp-content/plugins/everest-forms-pro/ directory for suspicious activity

How to Mitigate CVE-2025-5927

Immediate Actions Required

• Update Everest Forms Pro plugin to the latest version that addresses this vulnerability immediately
• Review recent form entries for suspicious path traversal patterns before deleting any entries
• Implement file integrity monitoring on critical WordPress configuration files
• Consider temporarily disabling the Everest Forms Pro plugin until patching is complete
• Audit web server logs for any evidence of exploitation attempts

Patch Information

Users should update the Everest Forms Pro plugin to a version beyond 1.9.4 that includes the security fix for CVE-2025-5927. The update addresses the file path validation issue in the delete_entry_files() function. For detailed changelog information, refer to the Everest Forms Changelog. Additional vulnerability analysis is available from the Wordfence Vulnerability Analysis.

Workarounds

• Restrict administrative access to trusted users only and limit the number of users with form entry deletion privileges
• Implement a web application firewall (WAF) rule to sanitize or block requests containing path traversal sequences
• Enable two-factor authentication for WordPress administrator accounts to reduce the risk of compromised admin actions
• Create read-only backups of critical WordPress files such as wp-config.php that can be quickly restored if deleted

# Configuration example - Protect critical WordPress files using .htaccess
# Add to WordPress root .htaccess file

<FilesMatch "^wp-config\.php$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>