The Everest Forms (Pro) plugin contains an insufficient file path validation flaw in the delete_entry_files() function, classified as CWE‑36. This flaw allows an attacker to specify malicious file paths when triggering the entry‑deletion process, resulting in the deletion of arbitrary files on the server. If critical files such as wp‑config.php are removed, the removal can lead to immediate remote code execution or other severe compromise of the WordPress installation.

The vulnerability affects the WPEverest Everest Forms Pro plugin for WordPress. All released versions up to and including 1.9.4 are susceptible. The affected product is listed under the vendor WPEverest and the product name Everest Forms Pro.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of 2% indicates a low current exploit probability. The weakness is not currently listed in CISA’s KEV catalog. Attackers can attempt to exploit the vulnerability by sending crafted deletion requests; however, the deletion action must be initiated by an authenticated administrator deleting a form entry, so the exploitation path requires both unauthenticated manipulation and an admin trigger. From the available data, the threat is considered high severity but with a low likelihood of active exploitation in the present environment.