The vulnerability arises from the Everest Forms WordPress plugin misinterpreting the ‘old_files’ field submitted by users. By injecting a path‑traversal string into that parameter, an unauthenticated attacker can cause the plugin to convert the payload into a local filesystem path and attach the file to outgoing emails or delete it during cleanup. The flaw is a classic directory traversal (CWE‑22) that permits reading critical files such as wp‑config.php and deleting any file the web server can reach, which can undo authentication keys, override core files, or disable the site. This can result in complete compromise of the WordPress installation, data loss, or denial of service.

The issue affects the Everest Forms plugin from wpeverest, in all releases up to and including 3.4.4. WordPress sites that install any of those versions and use a form containing a file‑upload or image‑upload field, with the option to store entry information enabled, are vulnerable.

The CVSS score of 8.1 indicates a high severity. No EPSS metric is available, but the lack of an EPSS rating suggests the exploitation likelihood is not quantified. The vulnerability is not listed in the CISA KEV catalog, and no publicly available proof‑of‑concept code is cited. The attack vector is inferred to be unauthenticated remote: any entity can submit a crafted form submission to trigger the file read or delete action. Because the flaw occurs before the form data is processed for permanent storage, an attacker can replay the request multiple times or target different files until a vulnerability is exposed. The overall risk is significant, especially for sites that rely on Everest Forms for file uploads.